AI analysis
Adobe Connect contains a stored cross-site scripting (XSS) flaw (CWE-79) in which an attacker injects malicious JavaScript into vulnerable form fields, and the server persists that payload. The script executes in a victim's browser when they browse to the page containing the injected field, allowing the attacker to potentially gain elevated access or take control of the victim's account or session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) indicates the attacker needs no privileges or authentication but requires victim interaction, and because scope is changed, the impact extends beyond the vulnerable page's own security context. The advisory data does not specify which Adobe Connect versions are affected, so administrators should treat current deployments as potentially vulnerable until Adobe's bulletin confirms the fixed version. There is no known public proof of concept, no reported in-the-wild exploitation, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Monitor Adobe's security bulletin (APSB) for Adobe Connect and apply the fixed release to on-premises/licensed deployments as soon as version details are published; Adobe-hosted accounts are patched by Adobe directly. Because stored payloads persist, review form-field data and server logs for injected script content and force session resets for any users who may have viewed tampered pages. Since exploitation requires no attacker authentication and only victim interaction, brief users to report unexpected prompts or behavior during Connect sessions.
Estimated exposure
moderate≈ low thousands (roughly 1,000–10,000) of internet-exposed on-premises Adobe Connect servers, plus an unknown number of Adobe-hosted SaaS tenants — No install or deployment counts were provided; the estimate is based on public internet scan services (e.g., Shodan) historically showing low-thousands counts of internet-facing on-prem Adobe Connect hosts, while most remaining usage is…
Description
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.