EUVD-2026-84787
GHSA-x6f5-hr52-265c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Stored injection into form fields typically needs an authenticated submit (PR:L); victim must view the page (UI:R); browser-context script yields limited C:L/I:L, and S:C reflects execution in a separate browser security context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
AnalysisAI
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker to place a persistent JavaScript payload into a vulnerable Adobe Connect form field and a victim to subsequently browse to the page that renders that field (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Adobe's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N = 9.3 Critical) frames this stored XSS as a near-worst-case web flaw, but two signals temper that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply Adobe's vendor update for this issue as published in security bulletin APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html); the advisory is the authoritative source for the exact patched version for both the Adobe Connect server/web deployment and the Adobe Connect Android mobile app, since no fix version number is specified in the supplied intelligence, and admins should confirm the latest release on that page rather than assume a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Adobe Connect and the Adobe Connect Android mobile app (all versions) in use, enforce input validation and output encoding on all form fields, enable Web Application Firewall (WAF) rules to detect and block XSS attempts, and instruct users to avoid clicking untrusted links or submitting data to suspicious forms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today