CVE-2026-75697: Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to submit malicious script content into a vulnerable Adobe Connect form field. No privileges are required according to the supplied vector, but a victim must browse to the page containing the stored payload for it to execute.
Who is exposed to the malicious script?
Users who browse to the Adobe Connect page containing the attacker-controlled vulnerable field may execute the script in their browser. The issue can potentially give the attacker elevated access to or control over the victim's account or session.