CVE-2026-75684

Adobe Connect contains a stored cross-site scripting (XSS) flaw (CWE-79) in which an attacker injects malicious JavaScript into vulnerable form fields, and the server persists that payload. The script executes in a victim's browser when they browse to the page containing the injected field, allowing the attacker to potentially gain elevated access or take control of the victim's account or session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) indicates the attacker needs no privileges or authentication but requires victim interaction, and because scope is changed, the impact extends beyond the vulnerable page's own security context. The advisory data does not specify which Adobe Connect versions are affected, so administrators should treat current deployments as potentially vulnerable until Adobe's bulletin confirms the fixed version. There is no known public proof of concept, no reported in-the-wild exploitation, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Monitor Adobe's security bulletin (APSB) for Adobe Connect and apply the fixed release to on-premises/licensed deployments as soon as version details are published; Adobe-hosted accounts are patched by Adobe directly. Because stored payloads persist, review form-field data and server logs for injected script content and force session resets for any users who may have viewed tampered pages. Since exploitation requires no attacker authentication and only victim interaction, brief users to report unexpected prompts or behavior during Connect sessions.