CVE-2026-75698

Adobe Connect contains a reflected cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into a web page viewed by a victim. Exploitation requires user interaction, such as convincing a target to click a specially crafted link, but requires no authentication or privileges on the server. Because the CVSS scope is 'changed' with high confidentiality and impact ratings, successful exploitation could let the attacker steal session credentials or take control of the victim's Adobe Connect account in the browser context beyond the vulnerable component. Both Adobe-hosted and on-premise Adobe Connect deployments should be considered affected until patched, though the advisory data does not enumerate specific version ranges. There is no evidence of exploitation in the wild and no public proof of concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Check the corresponding Adobe security bulletin (APSB) for the fixed Adobe Connect version and apply the update to on-premise or managed-service deployments immediately; hosted customers should confirm with Adobe that their cluster has been patched. In the interim, warn users not to click unexpected meeting or portal links, and consider browser protections such as XSS auditing and blocking third-party scripts on Adobe Connect URLs.