EUVD-2026-84781
GHSA-mf8f-7xm6-6m2x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated remote reflected XSS gated on victim interaction (UI:R) with cross-context scope change (S:C); reflected XSS impact is realistically Low confidentiality/integrity, not High as vendor rated.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
AnalysisAI
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires user interaction: a victim who is (typically) an authenticated Adobe Connect user must visit a maliciously crafted URL or interact with a compromised web page that reflects the attacker's script (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3 Critical) describes a network-reachable, unauthenticated, low-complexity reflected XSS whose only barrier is user interaction (UI:R) and whose scope change (S:C) plus C:H/I:H reflect the ability to compromise a victim's authenticated session/account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the latest security updates for Adobe Connect as provided in Adobe's security advisory apsb26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, deploy web application firewall (WAF) rules to block reflected XSS payloads targeting Adobe Connect and instruct users to avoid clicking untrusted links; within 7 days, enforce Content Security Policy (CSP) headers on Adobe Connect instances, review Adobe's advisory for updates, and conduct user awareness training on phishing and suspicious URLs; within 30 days, continuously monitor for a vendor patch and apply it immediately upon release, while performing a security review to detect any signs of compromise.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today