EUVD-2026-84779
GHSA-56cm-jfr2-267x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Agree with vendor: network-reachable stored XSS, victim must view the page (UI:R), execution in browser context changes scope (S:C) enabling session/account takeover (C:H/I:H), no availability impact; PR:N accepted per vendor but borderline given injection prerequisite.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
AnalysisAI
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an attacker able to submit content into a vulnerable Adobe Connect form field so a malicious script is stored server-side, and (2) a victim subsequently browsing to the page that renders that field (UI:R) - the payload does not fire without victim interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor CVSS 3.1 rates this 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), driven by network reach, no privileges, and a scope change reflecting that script executes in the victim's browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed in the provided input data; consult Adobe advisory apsb26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html) for the vendor-released fixed version and apply it to Adobe Connect and the Android mobile app as soon as it is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Adobe Connect web application and Adobe Connect Android Mobile App in use, confirm exposure, and alert users to avoid untrusted meeting invitations or content; enable enhanced logging and monitoring for anomalous script injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today