{"id":"CVE-2026-121904","kind":"vulnerability","aliases":["CVE-2026-121904"],"related":[],"title":"Adobe Connect: stored XSS in form fields lets scripts run in victims' browsers","description":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.","summary":"Adobe Connect has a stored cross-site scripting flaw in some form fields. A low-privileged attacker can save malicious JavaScript that runs in the browser of anyone who opens the affected page, potentially taking over their session or account.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-connect","self-hosted","vendor","windows","xss"],"not_affected_if":["unknown"],"how_to_check":"Check your Adobe Connect server version (Windows, on-prem). Versions 12.12 and earlier without the 12.12.a / 12.11.i / 12.10.f / 12.9.a / 12.8.a update are listed as affected by Adobe in APSB26-191.","fix":"Update Adobe Connect (Windows) to 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (whichever branch you run), per APSB26-191.","status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:44+00:00","updated_at":"2026-11-10T22:30:34+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Adobe Connect: stored XSS in form fields lets scripts run in victims' browsers","impact":"medium","summary":"Adobe Connect has a stored cross-site scripting flaw in some form fields. A low-privileged attacker can save malicious JavaScript that runs in the browser of anyone who opens the affected page, potentially taking over their session or account.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"victim sessions hijacked through scripts running in their browser","analyst_note":"Find the Adobe security bulletin for CVE-2026-121904 to confirm affected versions, vulnerable fields and the fixed release; the NVD page alone gives no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"Adobe Connect","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run or use Adobe Connect and have users with low-privileged accounts able to enter text into form fields. Whether a given deployment is exposed depends on which fields are vulnerable, which the sources do not list. unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000706,"input_tokens":4591,"output_tokens":493,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for CVE-2026-121904 to confirm affected versions, vulnerable fields and the fixed release; the NVD page alone gives no product ranges.","search":"'-121904':16A,19A '-2026':15A,18A 'abus':89C 'access':127C 'account':72B,134C 'adob':1A,23B,31B,73C 'adobe':20A 'adobe-connect':22B 'affect':64B,76C 'anyon':60B 'attack':49B,95C 'brows':116C 'browser':13A,58B,113C 'chang':139C 'connect':2A,21A,24B,32B,74C 'contain':120C 'control':129C 'could':87C 'cross':37B,81C 'cross-sit':36B,80C 'cve':14A,17A 'elev':126C 'execut':108C 'field':7A,44B,103C,123C 'flaw':40B 'form':6A,43B,102C 'gain':125C 'host':27B 'inject':97C 'javascript':53B,105C 'let':8A 'low':47B,93C 'low-privileg':46B,92C 'malici':52B,98C,104C 'may':106C 'open':62B 'page':65B,119C 'potenti':66B,124C 'privileg':48B,94C 'run':10A,55B 'save':51B 'scope':137C 'script':9A,39B,83C,99C 'self':26B 'self-host':25B 'session':70B,136C 'site':38B,82C 'store':3A,35B,79C 'take':67B 'vendor':28B 'victim':12A,111C,132C 'vulner':85C,101C,122C 'window':29B 'xss':4A,30B,84C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Adobe Connect on Windows, version 12.12 and earlier, is listed as affected. An attacker with a low-privileged account can store a script (user interaction needed) that runs in another user's browser, enabling session or account takeover. Adobe's bulletin does not say which form fields are vulnerable, and lists only Windows for this bulletin. Adobe says no exploits in the wild are known.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:30:34Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2989},"products":{"at":"2026-11-10T22:30:34Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2989},"how_to_check":{"at":"2026-11-10T22:30:34Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2989},"who_affected":{"at":"2026-11-10T22:30:34Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2989}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","selfhosted","vendor","windows","xss"],"campaign_type":null,"search_a":"'-121904':16A,19A '-2026':15A,18A 'adob':1A 'adobe':20A 'browser':13A 'connect':2A,21A 'cve':14A,17A 'field':7A 'form':6A 'let':8A 'run':10A 'script':9A 'store':3A 'victim':12A 'xss':4A","search_b":"'account':72B 'adob':23B,31B 'adobe-connect':22B 'affect':64B 'anyon':60B 'attack':49B 'browser':58B 'connect':24B,32B 'cross':37B 'cross-sit':36B 'field':44B 'flaw':40B 'form':43B 'host':27B 'javascript':53B 'low':47B 'low-privileg':46B 'malici':52B 'open':62B 'page':65B 'potenti':66B 'privileg':48B 'run':55B 'save':51B 'script':39B 'self':26B 'self-host':25B 'session':70B 'site':38B 'store':35B 'take':67B 'vendor':28B 'window':29B 'xss':30B","search_c":"'abus':89C 'access':127C 'account':134C 'adob':73C 'affect':76C 'attack':95C 'brows':116C 'browser':113C 'chang':139C 'connect':74C 'contain':120C 'control':129C 'could':87C 'cross':81C 'cross-sit':80C 'elev':126C 'execut':108C 'field':103C,123C 'form':102C 'gain':125C 'inject':97C 'javascript':105C 'low':93C 'low-privileg':92C 'malici':98C,104C 'may':106C 'page':119C 'potenti':124C 'privileg':94C 'scope':137C 'script':83C,99C 'session':136C 'site':82C 'store':79C 'victim':111C,132C 'vulner':85C,101C,122C 'xss':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121904","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121904:2989","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:30:34+00:00","modified_at":"2026-11-10T22:30:34+00:00","first_seen_at":"2026-11-10T22:30:34+00:00","fetched_at":"2026-11-10T22:30:34+00:00","note":"Read Adobe APSB26-191 (Nov 10 2026): stored XSS, CVSS 9.6, no in-the-wild exploits; bulletin doesn't name the vulnerable fields. Fixed builds per branch listed.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}