Adobe Connect: Stored Cross-Site Scripting in form fields
Summary
Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability in form fields. A low-privileged user can store malicious scripts that run in the browser of a victim who opens the affected page. This can expose session or account data and can affect more than the vulnerable component, because the scope is changed. User interaction is required.
Affected
- Adobe Connect 12.12 and earlier (Windows), according to the CVE record and the Adobe bulletin summary
- Per-branch ranges in the CVE record: 12.8, 12.9, 12.10, 12.11 and 12.12 (earlier builds on each branch are listed as affected)
- Adobe Connect Android and desktop app versions: Unknown.
Fixed in
- Adobe Connect 12.8.a
- Adobe Connect 12.9.a
- Adobe Connect 12.10.f
- Adobe Connect 12.11.i
- Adobe Connect 12.12.a
- The CVE record's ranges are ambiguous; verify the exact fixed build per branch in Adobe bulletin APSB26-191.
Workaround
Unknown. No vendor workaround was found. Apply the update.
Exploitation
- Adobe states it is not aware of any exploits in the wild for the issues in APSB26-191.
- No public proof of concept was found at the time of writing. Coverage is limited because the CVE was published on 2026-11-10.
Our recommendation
- Update Adobe Connect to the fixed build for your branch, prioritising self-hosted servers and instances that accept external users or guest accounts.
- Limit who holds low-privilege accounts and review accounts you do not need.
- Check whether your instance is internet-facing.
- Treat APSB26-191 as a whole, since it contains other Connect CVEs with higher CVSS scores.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE Record CVE-2026-122102 www.cve.org
- Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
- OffSeq Threat Radar CVE-2026-122102 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:56.
Original description (NVD)
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.