Adobe Connect Android Mobile App
Monthly
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). Impact stays confined to the victim's browser session (S:C with C:L/I:L - session/cookie theft, spoofed content, or actions as the victim), there is no server-side code execution or data-store compromise, no public exploit identified at time of analysis, and no CISA KEV listing; overall this is a genuine but modest, moderate-severity issue rather than a top-priority emergency.
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). Impact stays confined to the victim's browser session (S:C with C:L/I:L - session/cookie theft, spoofed content, or actions as the victim), there is no server-side code execution or data-store compromise, no public exploit identified at time of analysis, and no CISA KEV listing; overall this is a genuine but modest, moderate-severity issue rather than a top-priority emergency.