CVE-2026-75697

Adobe Connect contains a stored Cross-Site Scripting (XSS) flaw in which an attacker injects malicious JavaScript into vulnerable form fields without needing any privileges. When a legitimate user, such as a host or administrator, views the page containing the injected field, the script executes in their browser, potentially allowing the attacker to hijack the victim's session or take actions with elevated access on their account. The CVSS 3.1 base score is 9.3 (critical), driven by the changed scope and high confidentiality and integrity impact, though the attack requires user interaction (the victim must browse to the affected page). Anyone running an affected Adobe Connect deployment, or users of Adobe's hosted Connect service, is potentially impacted, with administrators and meeting hosts being the highest-value targets. There is no known public proof of concept and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the update specified in Adobe's Connect security bulletin (APSB) as soon as it is released, prioritizing on-premises/licensed deployments since Adobe-hosted instances are patched by Adobe. Administrators should audit stored user-supplied content (form submissions, profiles, custom fields, pods) for injected scripts and review logs for suspicious entries, and check whether any host or admin accounts show anomalous activity. As an interim mitigation, restrict who can submit content to the affected fields and consider Content Security Policy enforcement where the deployment allows it.