Adobe Connect: Cross-site scripting (XSS)
Summary
Adobe Connect 12.12 and earlier contains a cross-site scripting vulnerability (CWE-79) that Adobe fixed in APSB26-191. An attacker with a low-privileged account could convince a victim to visit a crafted URL, so that malicious JavaScript runs in the victim's browser. Scope is changed and the CVSS score is 5.4 (medium). Adobe lists the impact as arbitrary code execution, while the CVSS vector implies limited confidentiality and integrity impact.
Affected
- Adobe Connect 12.12 and earlier (Windows, per Adobe advisory APSB26-191)
Fixed in
- 12.12.a
- 12.11.i
- 12.10.f
- 12.9.a
- 12.8.a
A plain version such as 12.12 is still vulnerable. Check the exact build string.
Workaround
Unknown. No vendor workaround is published. Installing the fixed build is the fix. Until then, avoid opening untrusted links to Connect pages.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- No public proof of concept found.
- A third-party write-up reports no CISA KEV listing as of 11 Nov 2026. This was not verified directly.
Our recommendation
- Inventory all Adobe Connect instances and record the exact build string.
- Update to the fixed build for your branch as listed in APSB26-191. The same update covers 24 CVEs, so plan one window.
- Re-verify the build string after patching.
- Review Connect accounts and disable guest access if it is not required.
- Warn users about phishing links pointing to Connect pages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE-2026-121910 at cve.threatint.com cve.threatint.com
- CVE-2026-121910 at OpenCVE app.opencve.io
- The November 2026 Security Update Review (ZDI) www.thezdi.com
- Adobe Connect APSB26-191 write-up (DEV) dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:17.
Original description (NVD)
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.