External risk intelligence

Adobe Connect Reflected Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75698

Adobe Connect is a web-conferencing and collaboration platform designed to be accessible via the internet for meetings, training, and webinars. Because it is commonly deployed as a public-facing web service for external participants and remote access, it frequently presents an internet-accessible attack surface.

Cross-site Scripting

Adobe Connect

before 12.12before 4.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a reflected Cross-Site Scripting vulnerability in Adobe Connect. An attacker could potentially inject malicious scripts by tricking a user into visiting a crafted link or interacting with a compromised page. This could lead to unauthorized access or control over a user's account or session.

Malicious scripts can be injected into web pages.
Affects user accounts and session control.
Confirm relevance and exposure for Adobe Connect.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this reflected Cross-Site Scripting (XSS) vulnerability by luring a user to a specially crafted link. If the user clicks this link, malicious scripts can be injected into the web page. This could potentially allow the attacker to gain unauthorized access or control over the user's session within Adobe Connect.

No special access is required.
Victim must visit a malicious link.
Risk of elevated access or session control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious scripts into a web page when a user visits a crafted URL or interacts with a compromised page. This might lead to unauthorized access or control over a user's account or session, as the scope of the vulnerability changes.

User session data.
Malicious link or page interaction.
Account control or session hijacking.

Operational Fix

Recommended remediation, mitigation, and detection steps

This reflected Cross-Site Scripting vulnerability in Adobe Connect impacts web-conferencing and collaboration. Ownership likely falls to the platform or application team managing Adobe Connect deployments, with vendor management engaged if significant customization or vendor-hosted instances are involved. The first practical step is to identify all Adobe Connect instances, confirm their internet accessibility and business criticality, and determine the accountable owner for each. Subsequent planning should prioritize remediation for the most exposed and critical systems.

Platform/application team owns the issue.
Verify internet-facing Adobe Connect instances.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a software platform used for web conferencing, online training, and virtual webinars. It enables organizations to host collaborative meetings and deliver digital learning content to participants. Because it supports remote access and external attendees, it is often deployed as a web-based service accessible via a browser or mobile application.

What does CVE-2026-75698 mean by reflected XSS?

This CVE involves Reflected Cross-Site Scripting (CWE-79). It means the application fails to properly sanitize user-supplied data before including it in a web page. When a user visits a malicious link containing a hidden script, the application reflects that script back to the user's browser, where it executes within the context of the site, potentially compromising their session.

How is this vulnerability triggered?

An attacker triggers the vulnerability by tricking a victim into clicking a specially crafted URL or interacting with a compromised web page. It does not trigger through automated background scanning or by simply having the software installed; the execution relies specifically on a user actively visiting the malicious link while authenticated or interacting with the site.

Do I need to worry about this if my instance is internal?

According to Halo Surface Signal, Adobe Connect is typically designed as a public-facing service for webinars and external participants, which increases the likelihood of internet accessibility. If your instance is strictly internal, the risk may be lower; however, you should still evaluate if any parts of the deployment are exposed to the public internet, as that significantly increases the potential for external exploitation.

What are the first steps to address CVE-2026-75698?

Start by identifying all deployed Adobe Connect instances across your environment. Once you have a list, verify which ones are accessible over the internet and determine their business criticality. Assign an owner to each instance to manage the update process, and prioritize patching based on those that are most exposed to public traffic.

References

helpx.adobe.com/security/products/connect/apsb26-150.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.