CVE-2026-21331
Reflected XSS in Adobe Connect Allows Browser-Based Code Execution
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | connect | to 12.11 (exc) |
| adobe | connect_desktop_application | to 2025.3 (inc) |
| adobe | connect_desktop_application | to 2025.9.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected Cross-Site Scripting (XSS) issue affecting Adobe Connect versions 2025.3, 12.10, and earlier. It occurs when an attacker tricks a victim into visiting a specially crafted URL that references a vulnerable page. When the victim visits this URL, malicious JavaScript code can be executed within the victim's browser context.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can execute malicious JavaScript code in the victim's browser. This can lead to unauthorized actions such as stealing sensitive information, hijacking user sessions, or performing actions on behalf of the victim without their consent.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a reflected Cross-Site Scripting (XSS) issue in Adobe Connect versions 2025.3, 12.10 and earlier, which allows execution of malicious JavaScript in the victim's browser context if they visit a crafted URL.
Such XSS vulnerabilities can potentially lead to unauthorized access to sensitive information or session hijacking, which may impact compliance with data protection regulations like GDPR or HIPAA by compromising confidentiality and integrity of user data.
However, specific impacts on compliance depend on the context of use, data handled, and mitigation measures in place.