CVE-2026-75689

Adobe Connect, Adobe's web conferencing and virtual-training platform, contains a stored Cross-Site Scripting (XSS) flaw (CWE-79) in which an attacker can permanently inject malicious JavaScript into vulnerable form fields. The malicious script executes in a victim's browser when they visit the page containing the injected content, requiring only that the victim interact with the poisoned page (UI:R) with no privileges needed from the attacker (PR:N). Because the vulnerability's scope is changed (S:C) with high confidentiality and integrity impact, successful exploitation can allow the attacker to steal session tokens and gain elevated access or full control over the victim's account — particularly damaging if the victim is a meeting host or administrator. Both Adobe-hosted (SaaS) and on-premises/licensed Adobe Connect deployments are the affected product family, though the exact vulnerable versions were not stated in the source data and should be confirmed against Adobe's security bulletin. No public proof-of-concept exists, the flaw is not on CISA's Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the fixed version identified in Adobe's security bulletin for this CVE as soon as it is available, prioritizing on-premises/licensed deployments that do not auto-update — Adobe-hosted SaaS instances are typically patched by Adobe directly. Until patched, restrict who can submit content to meeting forms and profile/poll/chat fields that render to other participants, and review those fields for unexpected injected scripts. Monitor for anomalous session activity by hosts and administrators, since successful exploitation yields account or session takeover, and consider resetting credentials for any account observed interacting with suspicious injected content.