CVE-2026-75697CWE-79cross-site-scripting

CVE-2026-75697

Critical · published September 22, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
21.8
In the wild
Unconfirmed
What it is

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 21.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-22T23:16Z
Affected products (2)
ProductVersionsFixed in
adobe/connect< 12.1212.12
adobe/connect_for_mobile< 4.54.5
References (1)
https://helpx.adobe.com/security/products/connect/apsb26-150.html · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 22 SEP 18:53Z
    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
    cvelistv5