{"id":"CVE-2026-121904","published":"2026-11-10T22:18:27.280","lastModified":"2026-11-10T22:18:27.280","description":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stored XSS vulnerability in Adobe Connect allows low-privileged attackers to inject malicious scripts into form fields, which execute in victims' browsers when they view the compromised page, enabling session hijacking or account takeover with elevated scope.","exploitability":"Exploitation requires only low-privileged access and no user interaction beyond visiting a maliciously crafted page; the attack is straightforward for authenticated attackers.","blast_radius":"Successful exploitation could lead to full compromise of victim accounts, including unauthorized data access, privilege escalation within the application, or lateral movement via compromised sessions.","remediation":"Upgrade to Adobe Connect version 2.590 or later, as this is the first version that addresses CVE-2026-121904.","detection":"Defenders should monitor for anomalous script injection attempts in form submission logs (e.g., unexpected <script>, onerror, or javascript: URIs in user-provided fields) and inspect server-side logs for requests containing unsanitized XSS payloads to endpoints handling content creation or profile updates.","tags":["xss","stored","web","privilege-escalation","session-hijack"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:56:08.079Z"}}