CVE-2026-75689: Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an attacker to be authenticated?
No privileges are required according to the CVSS vector. The issue is network-accessible and has low attack complexity.
Does a victim need to take any action for the payload to execute?
Yes. Malicious JavaScript executes when a victim browses to the page containing the vulnerable form field.
What is the likely impact if a victim loads an injected page?
An attacker may execute scripts in the victim's browser and potentially gain elevated access to or control over the victim's account or session. The vulnerability has high confidentiality and integrity impact, with changed scope.