Adobe Connect: Stored Cross-Site Scripting (XSS) in form fields
Summary
Adobe Connect is affected by a stored Cross-Site Scripting vulnerability (CVE-2026-121904) in form fields. An attacker with a low-privilege account can store malicious JavaScript that runs in the browser of users who open the affected page, which could allow session or account takeover. Adobe rates it CVSS 9.6 (Critical) with a changed scope.
Affected
- Adobe Connect 12.8 and earlier, 12.9 and earlier, 12.10 and earlier, 12.11 and earlier, and 12.12 and earlier according to the CNA record and bulletin APSB26-191 (Windows).
- Third-party aggregators list different ranges; the CNA record and vendor bulletin take precedence.
Fixed in
- Adobe Connect 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a according to the APSB26-191 update table and the CNA record.
- Confirm the exact build for this CVE in the advisory and release notes before upgrading.
Workaround
Unknown. The vendor's mitigations could not be verified.
- Generic measure: restrict access to trusted users and review guest or external accounts.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-191.
- Not listed as known exploited by one aggregator.
- No public proof of concept found; this does not rule one out.
Our recommendation
- Check whether you run a hosted or self-managed Adobe Connect instance and whether it is reachable from the internet.
- Apply the full APSB26-191 update (24 CVEs) as Adobe Deployment Priority 2, starting with internet-facing instances.
- Review guest, self-registered and external accounts and remove unused ones.
- Monitor for unusual script content in form input fields until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-121904 www.cve.org
- Adobe Security Bulletin APSB26-191 www.adobe.com
- Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
- Adobe Security Bulletin APSB26-150 helpx.adobe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:33.
Original description (NVD)
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.