Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can convince a victim to visit a URL referencing a vulnerable page, leading to the execution of malicious JavaScript content in the victim’s browser. This vulnerability changes the scope of the attack.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2026-21331 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL that targets a vulnerable page in Adobe Connect. By persuading a victim to click on this URL, the attacker can execute arbitrary JavaScript in the context of the victim’s browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- Adobe Connect 2025.3: Affected by XSS vulnerability allowing execution of malicious scripts.
- Adobe Connect 12.10: Vulnerable to reflected XSS attacks that can compromise user sessions.
- Earlier versions: All versions prior to 2025.3 and 12.10 are also susceptible to this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Connect that addresses the XSS issue. Additionally, organizations should implement security best practices such as input validation and user education to reduce the risk of falling victim to such attacks.