Advisory · CVE-2026-75689
Stored XSS in Adobe Connect can hijack sessions (CVE-2026-75689)
A stored cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
- Vendor
- Adobe
- Product
- Adobe Connect
- Identifier / CWE
- CVE-2026-75689
CWE-79 - Action timing
- Immediate
Explain it like I’m five
A community bulletin board lets anyone pin notes, and the board reads notes aloud exactly as written, including stage directions. An attacker pins stage directions that tell the reader to hand over their keys.
- 01Payload planted
An attacker injects malicious JavaScript into a vulnerable form field.
- 02Victim visits
A victim browses the page containing the vulnerable field.
- 03Script runs
The injected script executes in the victim's browser within the Connect origin.
- 04Session at risk
The attacker can gain elevated access or control over the victim's account or session, with changed scope.
What happened
Adobe security bulletin APSB26-150 addresses CVE-2026-75689, a stored cross-site scripting vulnerability (CWE-79) in Adobe Connect. An attacker can inject malicious scripts that execute in a victim’s browser, potentially gaining elevated access or control over the victim’s account or session, with changed scope. Exploitation requires user interaction. Adobe Connect up to and including 12.11 and the Android mobile app up to and including 4.4; fixed in 12.11.1 / 12.12 and Android app 4.5. NVD rates it CVSS 9.3 (v3.1).
What to do
- Upgrade Adobe Connect to 12.11.1 or 12.12 (and the Android app to 4.5).
- Advise users not to follow unexpected Connect links until patched.
- Review web logs for suspicious script payloads in form submissions.
Management note
XSS in a meeting platform is a session-theft path against hosts and presenters. Same bulletin, same upgrade as the Connect SQL injection; one maintenance window covers both.