Adobe Connect
Monthly
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserialization of untrusted data (CWE-502) and runs in the context of the current user. Exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page, so it is user-interaction gated rather than fully automatic. There is no public exploit identified at time of analysis and it is not on the CISA KEV list; EPSS is modest at 1.50% (81st percentile), consistent with SSVC scoring exploitation as 'none' despite a 'total' technical impact.
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. Adobe released patch APSB26-37. EPSS score of 1.50% (81st percentile) indicates moderate exploitation probability. No active exploitation confirmed (SSVC: exploitation=none), but deserialization flaws are commonly targeted once details emerge.
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privilege escalation when low-privileged authenticated users trick victims into visiting malicious URLs. The changed scope (CVSS S:C) indicates the vulnerability can affect resources beyond the vulnerable application's security context. EPSS data not available; no evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis. Requires user interaction (UI:R) but has low attack complexity (AC:L) and network-based attack vector (AV:N), making social engineering campaigns feasible.
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim browsers when users visit attacker-crafted webpages. The changed scope in CVSS vector (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security authority, potentially allowing lateral access to other Connect features or sessions. Adobe has released a patch in APSB26-37. EPSS exploitation probability is low (0.10%, 27th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting this is currently a theoretical risk rather than an imminent mass-exploitation threat.
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) indicates potential escape from Adobe Connect's application context to access other origins, elevating impact beyond typical reflected XSS. CVSS 9.3 reflects high confidentiality/integrity impact with scope change, though real-world exploitation requires social engineering (UI:R). EPSS score of 0.10% (27th percentile) and SSVC classification of non-automatable with no observed exploitation suggest this is lower priority than CVSS alone indicates, despite the high numerical score.
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.
Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, elevating the severity to 9.3 despite being 'just' XSS. Requires user interaction (clicking malicious link) but no authentication. EPSS score of 0.10% (27th percentile) suggests low probability of mass exploitation. CISA SSVC framework rates this as non-automatable with total technical impact but no observed exploitation, indicating priority for patch deployment in internet-facing Adobe Connect deployments but not emergency response level.
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). Impact stays confined to the victim's browser session (S:C with C:L/I:L - session/cookie theft, spoofed content, or actions as the victim), there is no server-side code execution or data-store compromise, no public exploit identified at time of analysis, and no CISA KEV listing; overall this is a genuine but modest, moderate-severity issue rather than a top-priority emergency.
Reflected cross-site scripting (XSS) in Adobe Connect 2025.3, 12.10, and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially compromising user session data and performing actions on behalf of the victim. The vulnerability affects multiple versions across a wide product scope and requires user interaction (clicking a malicious link) to trigger. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserialization of untrusted data (CWE-502) and runs in the context of the current user. Exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page, so it is user-interaction gated rather than fully automatic. There is no public exploit identified at time of analysis and it is not on the CISA KEV list; EPSS is modest at 1.50% (81st percentile), consistent with SSVC scoring exploitation as 'none' despite a 'total' technical impact.
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. Adobe released patch APSB26-37. EPSS score of 1.50% (81st percentile) indicates moderate exploitation probability. No active exploitation confirmed (SSVC: exploitation=none), but deserialization flaws are commonly targeted once details emerge.
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privilege escalation when low-privileged authenticated users trick victims into visiting malicious URLs. The changed scope (CVSS S:C) indicates the vulnerability can affect resources beyond the vulnerable application's security context. EPSS data not available; no evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis. Requires user interaction (UI:R) but has low attack complexity (AC:L) and network-based attack vector (AV:N), making social engineering campaigns feasible.
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim browsers when users visit attacker-crafted webpages. The changed scope in CVSS vector (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security authority, potentially allowing lateral access to other Connect features or sessions. Adobe has released a patch in APSB26-37. EPSS exploitation probability is low (0.10%, 27th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting this is currently a theoretical risk rather than an imminent mass-exploitation threat.
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) indicates potential escape from Adobe Connect's application context to access other origins, elevating impact beyond typical reflected XSS. CVSS 9.3 reflects high confidentiality/integrity impact with scope change, though real-world exploitation requires social engineering (UI:R). EPSS score of 0.10% (27th percentile) and SSVC classification of non-automatable with no observed exploitation suggest this is lower priority than CVSS alone indicates, despite the high numerical score.
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.
Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, elevating the severity to 9.3 despite being 'just' XSS. Requires user interaction (clicking malicious link) but no authentication. EPSS score of 0.10% (27th percentile) suggests low probability of mass exploitation. CISA SSVC framework rates this as non-automatable with total technical impact but no observed exploitation, indicating priority for patch deployment in internet-facing Adobe Connect deployments but not emergency response level.
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). Impact stays confined to the victim's browser session (S:C with C:L/I:L - session/cookie theft, spoofed content, or actions as the victim), there is no server-side code execution or data-store compromise, no public exploit identified at time of analysis, and no CISA KEV listing; overall this is a genuine but modest, moderate-severity issue rather than a top-priority emergency.
Reflected cross-site scripting (XSS) in Adobe Connect 2025.3, 12.10, and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially compromising user session data and performing actions on behalf of the victim. The vulnerability affects multiple versions across a wide product scope and requires user interaction (clicking a malicious link) to trigger. No public exploit code or active exploitation has been confirmed at the time of analysis.
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.