by Kastro
Paper/Archive/CVE-2026-75689

CVE-2026-75689

Adobe Adobe Connect — Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.7%CVSS 9.3
critical.is priorityof 100
39
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 54.8.548 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Connect≤ 12.1112.11.1, 12.12CNA
Adobe Connect Android Mobile App≤ 4.44.5CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/connect/apsb26-150.html