Adobe has patched a stored cross-site scripting flaw in Adobe Connect that, according to Adobe's advisory, could allow an unauthenticated attacker to plant malicious JavaScript in form fields and potentially hijack the accounts or sessions of users who later view the affected page.
What Is It
CVE-2026-75689 is a stored cross-site scripting vulnerability (CWE-79) in Adobe Connect. An attacker can inject malicious scripts into vulnerable form fields; the script is then stored and executed in a victim's browser when they browse to the page containing that field. Per Adobe's advisory, successful exploitation can potentially give the attacker elevated access or control over the victim's account or session.
The CVSS 3.1 base score is 9.3 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The record was published by Adobe PSIRT on 2026-09-22 and is currently in "Awaiting Analysis" status at NVD.
Why It Matters
The scoring is what pushes an XSS bug into critical territory here. The flaw is network-reachable, requires low attack complexity, and needs no privileges: an attacker does not need an account to plant the payload. User interaction is required, but that interaction is simply visiting the affected page. Scope is changed, and both confidentiality and integrity impact are rated High; availability is unaffected.
As of this writing, CVE-2026-75689 does not appear in CISA's Known Exploited Vulnerabilities catalog, and Adobe's advisory does not report exploitation in the wild. That means there is no public confirmation of active exploitation and no federal remediation deadline attached to this CVE. Absence from the KEV catalog is not evidence that exploitation is not occurring; only that none has been publicly confirmed, and the status can change as the catalog is updated.
What's Vulnerable
Per Adobe's affected-product data:
- Adobe Connect: versions 0 through 12.11 inclusive are affected. Versions 12.11.1 and 12.12 are unaffected.
- Adobe Connect Android Mobile App: versions 0 through 4.4 inclusive are affected. Version 4.5 is unaffected.
All other versions default to unaffected status.
Patch Status
Fixed builds are available. Adobe Connect users should move to 12.11.1 or 12.12; Adobe Connect Android Mobile App users should move to 4.5. Full details are in Adobe security bulletin APSB26-150. Adobe's advisory lists no workaround or mitigation beyond upgrading.
Sources
- NVD, CVE-2026-75689: https://nvd.nist.gov/vuln/detail/CVE-2026-75689
- Adobe Security Bulletin APSB26-150 (Adobe Connect): https://helpx.adobe.com/security/products/connect/apsb26-150.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog