Adobe Connect: Cross-site scripting in form fields
Summary
Adobe Connect contains a cross-site scripting (XSS) flaw in form fields (CVE-2026-121912, CVSS 5.4, Medium). An attacker with a low-privileged account can store malicious scripts in a vulnerable field. The script runs in a victim's browser when the victim opens the page that contains the field, and because the scope is changed, it can affect more than the vulnerable component. Confidentiality and integrity are affected at a low level, with no availability impact. The NVD entry was still awaiting analysis at the time of research.
Affected
- Adobe Connect 12.12 and earlier (per advisory APSB26-191, Windows)
- CVE record ranges: affected 0 to <= 12.8, 12.9, 12.10, 12.11 and 12.12
- Other platforms and builds (desktop app, macOS, mobile, self-hosted server): Unknown.
Fixed in
- 12.8.a
- 12.9.a
- 12.10.f
- 12.11.i
- 12.12.a
Adobe categorises the update as priority 2. The 12.11.i version is confirmed from the advisory only.
Workaround
Unknown. Adobe provides a patch and no vendor-published mitigation for this CVE was found.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- ZDI lists the bulletin as not exploited.
- The CVE is not listed in CISA's KEV catalogue (per OpenCVE).
- No public proof of concept found as of 11 Nov 2026.
Our recommendation
- Update Adobe Connect to the fixed version for your branch. Apply the full APSB26-191 update, which also covers Critical and High CVEs with privilege escalation and code execution impact.
- Inventory all Connect servers and clients on 12.12 or earlier and treat them as in scope.
- Confirm the deployment model (self-hosted and internet-exposed, or vendor-hosted) to assess exposure.
- Check the advisory release notes for platforms other than Windows.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE Record CVE-2026-121912 www.cve.org
- OpenCVE CVE-2026-121912 app.opencve.io
- ZDI November 2026 Security Update Review www.zerodayinitiative.com
- Strix CVE-2026-121912 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:17.
Original description (NVD)
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.