Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim’s account or session. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-34617 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or web page that, when visited by a user, executes the injected scripts. The attacker can then gain elevated access to the victim’s account or session, leading to potential unauthorized actions within the application.
Affected Products
- Adobe Connect 2025.3: Affected by XSS vulnerability allowing privilege escalation.
- Adobe Connect 12.10: Vulnerable to script injection leading to elevated access.
Mitigation
To mitigate this vulnerability, users should avoid clicking on untrusted links and ensure they are using the latest version of Adobe Connect. Regularly updating software and applying security patches can help protect against such vulnerabilities.