Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed Adobe Connect (Adobe): 12.11Adobe Connect Desktop Application (Adobe): 2025.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Adobe Connect | up to 12.10 | 12.11 | Patch available | CNA |
| Adobe | Adobe Connect Desktop Application | up to 2025.3 | 2025.9 | Patch available | CNA |
- Adobe Connect VendorAdobe Affected up to 12.10 Fixed in 12.11 Patch available CNA
- Adobe Connect Desktop Application VendorAdobe Affected up to 2025.3 Fixed in 2025.9 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:* | before 12.11 | Vulnerable | Adobe |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* | up to 2025.3 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:* | before 2025.9.15 | Vulnerable | Adobe |
- cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:* Versions before 12.11 Vulnerable ·Adobe
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* Versions up to 2025.3 Vulnerable ·Adobe
- cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:* Versions before 2025.9.15 Vulnerable ·Adobe
Remediation
- Fix · CNA Adobe Connect (Adobe) Fixed in 12.11
- Fix · CNA Adobe Connect Desktop Application (Adobe) Fixed in 2025.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Adobe Connect, Adobe Connect Desktop Application — helpx.adobe.com/security/products/connect/apsb26-37.html
8 records Highest priority Priority MEDIUM 6 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-21730 Adobe Connect | Deserialization of Untrusted Data (CWE-502)Priority MEDIUM 44
- TI-2026-26861 Adobe Connect | Deserialization of Untrusted Data (CWE-502)Priority MEDIUM 43
- TI-2026-21678 Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)Priority MEDIUM 42
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34614
- 2026-10-03 Alias added: GHSA-r4vr-qmwh-6j6q
References
More Adobe Connect vulnerabilities
- TI-2023-08504 Adobe Connect Improper Access Control Security feature bypass CVSS 3.1MEDIUM 5.3
- TI-2021-17669 Adobe Connect Deserialization of Untrusted Data Remote Code Execution CVSS 3.0CRITICAL 9.8
- TI-2018-09178 Improper authentication in Adobe Connect 9.7.5 and earlier CVSS 3.0CRITICAL 9.8
- TI-2023-04295 RCE in Saphira Connect CVSS 3.1CRITICAL 9.8
- TI-2023-04294 SQLi in Saphira Connect CVSS 3.1CRITICAL 9.8
- TI-2017-08334 Server-side request forgery in Adobe Connect 9.6.2 and earlier versions CVSS 3.0CRITICAL 10.0
Sources
- CVE-2026-34614 · CVE Program
- CVE-2026-34614 · NVD
- FIRST EPSS
- GHSA-r4vr-qmwh-6j6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences