Adobe has disclosed a critical stored cross-site scripting flaw in Adobe Connect and its Android mobile app that could allow an attacker to gain control over a victim's account or session, with no privileges required.
What Is It
CVE-2026-75684 is a stored Cross-Site Scripting vulnerability (CWE-79) in Adobe Connect. An attacker can inject malicious scripts into vulnerable form fields, which are then stored and served back to other users. When a victim browses to the page containing the injected field, the attacker's JavaScript executes in their browser; potentially granting elevated access or control over the victim's account or session.
Adobe's PSIRT rates it CVSS 3.1 9.3 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The record was published 2026-09-22 and is currently Awaiting Analysis at NVD.
Why It Matters
The score is driven by a changed scope: code injected into Connect executes in a victim's browser context, breaking out of the vulnerable component's security boundary. Network attack vector, low complexity, and no privileges required mean an unauthenticated attacker can plant the payload; only user interaction (visiting the affected page) is needed to fire it. Confidentiality and integrity impact are both rated High. Availability is unaffected.
Adobe Connect is a web conferencing and virtual classroom platform, so stored payloads sit in shared, multi-user content; a single injection can reach every user who loads the page.
What's Vulnerable
| Product | Affected | Fixed |
|---|---|---|
| Adobe Connect | 12.11 and earlier | 12.11.1, 12.12 |
| Adobe Connect Android Mobile App | 4.4 and earlier | 4.5 |
Both the server-side product and the Android client are in scope. No CPE data has been assigned yet.
Patch Status
Fixed builds are available. Upgrade Adobe Connect to 12.11.1 or 12.12, and the Adobe Connect Android Mobile App to 4.5. Details are in Adobe security bulletin APSB26-150.
Given the low attack complexity and lack of any privilege requirement, patching should be prioritized on internet-facing Connect deployments regardless of current exploitation reporting.
Sources
- Adobe Security Bulletin APSB26-150; https://helpx.adobe.com/security/products/connect/apsb26-150.html
- NVD, CVE-2026-75684, https://nvd.nist.gov/vuln/detail/CVE-2026-75684