CVE-2026-75697: Adobe Connect Stored XSS Vulnerability

CVE-2026-75697 Overview

Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] that allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the injected payload, the JavaScript executes in their browser context. The attack can lead to session hijacking, account takeover, or elevation of privileges within the Adobe Connect environment. The vulnerability has a changed scope, meaning injected code can affect resources beyond the vulnerable component. Adobe published a security bulletin tracking this issue as APSB26-150.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, hijack authenticated sessions, and gain elevated access to Adobe Connect accounts through persistent payloads stored in form fields.

Affected Products

Adobe Connect (see Adobe Security Bulletin APSB26-150 for affected versions)
Adobe Connect web meeting and virtual classroom deployments
Adobe Connect on-premises and hosted instances covered by APSB26-150

Discovery Timeline

2026-09-22 - CVE-2026-75697 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75697

Vulnerability Analysis

The flaw is a stored XSS weakness within Adobe Connect form field handling. The application accepts user-controlled input and persists it without adequate output encoding or input sanitization. When another user renders the page containing the stored payload, the browser interprets the injected content as executable JavaScript.

The vulnerability requires user interaction because a victim must load the affected page. Authentication is not required to plant the payload, which lowers the exploitation barrier. Scope is changed, indicating that a successful attack can impact resources managed by a security authority other than the vulnerable component, such as browser session tokens for adjacent origins or federated identity contexts.

Successful exploitation compromises confidentiality and integrity of user sessions. An attacker can steal session cookies, perform actions on behalf of the victim, or pivot to administrative functions if a privileged user views the payload.

Root Cause

The root cause is missing or insufficient neutralization of input during web page generation, categorized as [CWE-79]. Adobe Connect stores attacker-supplied content from form fields and later renders it in dynamic pages without escaping HTML control characters or applying a content security policy that blocks inline script execution.

Attack Vector

Exploitation is network-based and requires only low attack complexity. An unauthenticated attacker submits a crafted payload into a vulnerable form field. The payload persists in the application data store. When any user, including administrators, loads the page rendering that field, the malicious script executes in their session. Consult the Adobe Security Bulletin APSB26-150 for field-level technical details.

Detection Methods for CVE-2026-75697

Indicators of Compromise

Form field values containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or JavaScript URI schemes
Outbound HTTP requests from Adobe Connect user browsers to unknown external domains after page loads
Unexpected session cookie transmissions or authentication token reuse from unfamiliar geolocations
Anomalous administrative actions performed shortly after a privileged user browsed a shared meeting or content page

Detection Strategies

Inspect Adobe Connect application logs for form submissions containing script-like payloads or encoded HTML entities
Deploy web application firewall rules that flag XSS payload patterns targeting Adobe Connect endpoints
Correlate browser telemetry with server-side request logs to detect script execution originating from Adobe Connect pages
Review database records in Adobe Connect content stores for persisted HTML or JavaScript in user-editable fields

Monitoring Recommendations

Enable verbose HTTP request logging on Adobe Connect servers and forward events to a centralized SIEM
Monitor for spikes in failed Content Security Policy reports if CSP is enabled in reporting mode
Track session activity for anomalous privilege changes or content modifications following meeting attendance

How to Mitigate CVE-2026-75697

Immediate Actions Required

Apply the security update referenced in Adobe Security Bulletin APSB26-150 to all Adobe Connect instances
Audit stored content in meeting rooms, event pages, and user profile fields for existing malicious payloads
Invalidate active user sessions and force reauthentication after patching to break any hijacked sessions
Restrict administrative access to Adobe Connect until the patch is verified in production

Patch Information

Adobe released fixed builds addressed in security bulletin APSB26-150. Administrators should review the bulletin for the specific patched versions and apply the update using standard Adobe Connect maintenance procedures. Hosted customers should confirm that Adobe has applied the update to their tenant.

Workarounds

Enforce a strict Content Security Policy that disables inline JavaScript execution on Adobe Connect pages
Limit form field submission to trusted, authenticated users through upstream reverse proxy authentication
Deploy web application firewall signatures that block common XSS payloads targeting Adobe Connect URIs
Educate users to avoid clicking untrusted Adobe Connect meeting links until patching is complete

bash

# Example WAF rule concept for blocking common XSS payloads on Adobe Connect endpoints
# ModSecurity-style rule (adapt to your WAF syntax)
SecRule REQUEST_URI "@contains /connect/" \
  "chain,phase:2,deny,status:403,id:1075697,\
   msg:'CVE-2026-75697 Adobe Connect XSS payload blocked'"
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "t:none,t:urlDecodeUni,t:htmlEntityDecode"