{"id":"CVE-2026-121912","kind":"vulnerability","aliases":["CVE-2026-121912"],"related":[],"title":"Adobe Connect: stored XSS in form fields runs script in victims' browsers","description":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.","summary":"Adobe Connect has a cross-site scripting flaw in some form fields. A low-privileged user can store malicious JavaScript there, which runs in the browser of anyone who opens the page with that field.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:30:48+00:00","updated_at":"2026-11-10T22:30:48+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T22:30:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Connect: stored XSS in form fields runs script in victims' browsers","impact":"medium","summary":"Adobe Connect has a cross-site scripting flaw in some form fields. A low-privileged user can store malicious JavaScript there, which runs in the browser of anyone who opens the page with that field.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in victims' browsers, session data can be stolen","analyst_note":"Find affected Adobe Connect versions and the vendor's advisory with the fixed build; the NVD entry alone does not name them.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run Adobe Connect, where users with low privileges can enter content into form fields that other users later view. The sources do not name the affected versions or the exact fields. Deployments without untrusted users who can write to these fields are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4571,"output_tokens":438,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121912':15A,18A '-2026':14A,17A 'abus':78C 'adob':1A,20B,26B,63C 'adobe-connect':19B 'affect':66C 'anyon':55B 'attack':84C 'brows':105C 'browser':12A,53B,102C 'chang':115C 'connect':2A,21B,27B,64C 'contain':109C 'could':76C 'cross':31B,70C 'cross-sit':30B,69C 'cve':13A,16A 'execut':97C 'field':7A,38B,62B,92C,112C 'flaw':34B 'form':6A,37B,91C 'host':24B 'inject':86C 'javascript':47B,94C 'low':41B,82C 'low-privileg':40B,81C 'malici':46B,87C,93C 'may':95C 'open':57B 'page':59B,108C 'privileg':42B,83C 'run':8A,50B 'scope':113C 'script':9A,33B,72C,88C 'self':23B 'self-host':22B 'site':32B,71C 'store':3A,45B 'user':43B 'vendor':25B 'victim':11A,100C 'vulner':74C,90C,111C 'xss':4A,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Adobe Connect, where users with low privileges can enter content into form fields that other users later view. The sources do not name the affected versions or the exact fields. Deployments without untrusted users who can write to these fields are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobeconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-121912':15A,18A '-2026':14A,17A 'adob':1A 'browser':12A 'connect':2A 'cve':13A,16A 'field':7A 'form':6A 'run':8A 'script':9A 'store':3A 'victim':11A 'xss':4A","search_b":"'adob':20B,26B 'adobe-connect':19B 'anyon':55B 'browser':53B 'connect':21B,27B 'cross':31B 'cross-sit':30B 'field':38B,62B 'flaw':34B 'form':37B 'host':24B 'javascript':47B 'low':41B 'low-privileg':40B 'malici':46B 'open':57B 'page':59B 'privileg':42B 'run':50B 'script':33B 'self':23B 'self-host':22B 'site':32B 'store':45B 'user':43B 'vendor':25B","search_c":"'abus':78C 'adob':63C 'affect':66C 'attack':84C 'brows':105C 'browser':102C 'chang':115C 'connect':64C 'contain':109C 'could':76C 'cross':70C 'cross-sit':69C 'execut':97C 'field':92C,112C 'form':91C 'inject':86C 'javascript':94C 'low':82C 'low-privileg':81C 'malici':87C,93C 'may':95C 'page':108C 'privileg':83C 'scope':113C 'script':72C,88C 'site':71C 'victim':100C 'vulner':74C,90C,111C 'xss':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121912","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}