Adobe Connect has a stored cross-site scripting flaw (CVE-2026-121904, CVSS 9.6). A low-privileged attacker can use it to run malicious JavaScript in other users' browsers and possibly take over their accounts or sessions.
What Is It
CVE-2026-121904 is a stored cross-site scripting (XSS) vulnerability in Adobe Connect, classified as CWE-79. Adobe PSIRT says a low-privileged attacker can inject malicious scripts into vulnerable form fields. When a victim opens the page that contains the affected field, the injected JavaScript runs in their browser.
Adobe assigned a CVSS v3.1 base score of 9.6 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None (as scored)
- Scope: Changed
- Impact: High confidentiality, high integrity, no availability impact
Why It Matters
Because the XSS is stored, one injection can hit every user who later views the affected page. The attacker does not need to send each victim a crafted link. Adobe says successful exploitation could give the attacker "elevated access or control over the victim's account or session." The scope is marked as changed, so the impact reaches beyond the vulnerable component.
The attacker only needs a low-privileged account, and attack complexity is low. That makes any Connect deployment where many users can submit content a realistic target.
Exploitation status: The supplied CISA KEV data has no entry for this CVE, so CISA has not confirmed active exploitation. NVD lists the record as "Received" (published 2026-11-10), which means NVD has not finished its analysis yet.
What's Vulnerable
According to Adobe's affected-version data, the vulnerable Adobe Connect versions are:
| Branch | Affected | First Unaffected Version |
|---|---|---|
| 12.8 | ≤ 12.8 | 12.8.a |
| 12.9 | ≤ 12.9 | 12.9.a |
| 12.10 | ≤ 12.10 | 12.10.f |
| 12.11 | ≤ 12.11 | 12.11.i |
| 12.12 | ≤ 12.12 | 12.12.a |
The NVD record does not list any CPEs yet.
Patch Status
Adobe lists fixed versions for each affected branch. Administrators should update Adobe Connect to the unaffected release for their branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a. For official upgrade guidance, see Adobe security bulletin APSB26-191 on Adobe's security bulletin portal (helpx.adobe.com/security).
There is no CISA KEV entry, so no federal remediation deadline or KEV-mandated action applies to this CVE right now.