CVE-2026-75684

Executive Summary

CVE-2026-75684 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect, a widely deployed enterprise web conferencing and virtual classroom platform. An unauthenticated attacker can inject malicious JavaScript into vulnerable form fields; the script is persisted server-side and executed in the browser of any user who views the affected page, potentially allowing hijacking of the victim's account or session. With a CVSS base score of 9.3 (Scope Changed, High Confidentiality and Integrity impact), the flaw is rated Critical, though no public proof-of-concept, exploit code, or vendor patch evidence currently exists.

Technical Analysis

The vulnerability resides in the handling of user-supplied input within form fields on the Adobe Connect web application. Per CWE-79, the application fails to neutralize user-controllable input before it is placed into output that is served to other users — that is, the input is persisted (stored XSS) and later rendered without adequate encoding, sanitization, or contextual output escaping.

The attack mechanism is class-level and well understood: an attacker submits a crafted value into a form field that Adobe Connect accepts and stores. Because the value is not neutralized before being written to the data store and subsequently reflected into HTML/JavaScript context for other viewers, arbitrary script content is executed in the security context of the victim's browser when the page containing that field is browsed.

The CVSS vector provides several technically meaningful signals:

• AV:N (Network): Exploitable remotely over the network with no physical or adjacent access requirement.
• AC:L (Low): No specialized conditions or race windows are required.
• PR:N (None): No privileges are required to attempt the injection — consistent with an attacker reaching a form accessible without authentication, or with the injection being performed pre-authentication.
• UI:R (User Interaction Required): A victim must navigate to the page containing the vulnerable field for script execution to occur, which is the expected condition for stored XSS.
• S:C (Scope Changed): The exploited component's security authority is exceeded; script executes in the victim's browser security context, affecting resources beyond the vulnerable component's original scope.
• C:H / I:H (High Confidentiality / High Integrity): Successful exploitation can expose sensitive session or account data and permit modification of content or state within the victim's session.
• A:N (No Availability impact): No denial-of-service component.

The specific form field, parameter name, endpoint, output encoding function, or DOM sink involved is not disclosed in the available vulnerability data. No precise server-side or client-side code path can be asserted without fabricating implementation details. The analysis therefore remains at the vulnerability-class level: improper neutralization of input during web page generation (CWE-79) resulting in persistent script injection.

Adobe Connect is a multi-tenant, browser-delivered platform used for meetings, webinars, and training. Its user-facing surfaces typically include meeting rooms, content and recording viewers, scheduling forms, profile fields, and administrative consoles. Any of these surfaces that accepts and re-renders user input is a candidate attack surface for this class of flaw, but the available data does not identify which specific surface is affected.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (stored XSS) and the NVD description. No public proof-of-concept is available, and no specific function names, endpoints, or parameters are asserted because the source data does not disclose them.

1. Reconnaissance / target identification: An attacker identifies a reachable Adobe Connect deployment. Because the CVSS vector indicates PR:N, the injection point is expected to be reachable without authentication, or the attacker is able to reach it in the normal course of using the platform. Reconnaissance would focus on forms that accept user input and whose values are later displayed to other users.

2. Triggering the flaw: The attacker submits crafted input into a vulnerable form field. The application accepts and stores this value without neutralizing it (CWE-79). Persistence is the key differentiator from reflected XSS — the payload survives beyond the immediate request, so it can affect subsequent viewers.

3. Payload / execution method: When a victim browses to the page or view that renders the stored field, the value is emitted into the response without adequate contextual encoding, causing the attacker-supplied script to execute in the victim's browser. Script execution occurs in the victim's session context; because scope is changed (S:C), the script is not confined to the vulnerable component's authority.

4. Post-exploitation impact: Malicious JavaScript executing in the victim's browser can act on the victim's behalf — reading page content and session data consistent with the High Confidentiality rating, and performing actions or altering state consistent with the High Integrity rating. The NVD description explicitly frames the outcome as "potentially gaining elevated access or control over the victim's account or session." This could include session token theft, unauthorized actions within the platform, or redirection of the victim to attacker-controlled content. Availability is not impacted (A:N).

The primary uncertainty is the specific injection vector and the persistence and rendering surfaces. Attackers with knowledge of the deployment would enumerate forms and views; the generic chain above is the maximum that can be stated without inventing specifics.

Impact Assessment

This is a Critical-severity vulnerability (CVSS 9.3). The confidentiality and integrity subscores are both High, meaning a successful attack can expose protected data and allow modification of data or actions within the victim's session. The Scope:Changed rating indicates that the compromise crosses a trust boundary — the injected script operates with the authority of the victim's browser context rather than the vulnerable component's own.

Business impact for an enterprise running Adobe Connect includes:

• Account and session compromise for any user who views an affected page, with the attacker potentially acting as that user.
• Potential lateral movement within the platform if high-privilege users (administrators, meeting hosts, training managers) are targeted, since their sessions may carry elevated permissions.
• Data exposure of meeting content, recordings, user directories, or other information reachable within the victim's session.
• Compliance and reputational risk: XSS that results in session compromise is a standard finding in security audits and may implicate data protection obligations.

The blast radius is potentially organization-wide because the payload is stored: a single injected value can affect every user who subsequently views the containing page, and persistence means the exposure continues until the payload is removed or the application is fixed. EPSS has not yet scored this CVE, so no probabilistic exploitation-likelihood figure can be provided. CISA KEV does not list this CVE, and no public exploitation evidence is available. The affected version range is not published, so asset owners should assume all currently deployed Adobe Connect versions are potential candidates until Adobe confirms otherwise.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Injection Attempt Against Adobe Connect
id: 8f3c2a91-4b7e-4d21-9c6a-0a7d5e2f1b33
status: experimental
description: Detects suspicious script-like payloads submitted in HTTP requests to an Adobe Connect deployment, consistent with stored XSS injection attempts (CWE-79).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75684
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_payload:
    - 'cs-uri-query|contains':
        - '<script'
        - '%3Cscript'
        - 'javascript:'
        - 'onerror='
        - 'onload='
        - '<svg'
        - '<img'
  selection_target:
    cs-uri|contains: 'adobe'
  condition: selection_method and selection_payload and selection_target
falsepositives:
  - Legitimate rich-text or HTML content submitted by authorized users
  - Security scanning tools and penetration tests
level: high

YARA Rule

rule CVE_2026_75684_Adobe_Connect_Stored_XSS
{
    meta:
        description = "Detects common stored XSS payload indicators in captured HTTP request bodies targeting Adobe Connect form fields (CVE-2026-75684)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75684"
        cve = "CVE-2026-75684"

    strings:
        $s1 = "<script" nocase ascii wide
        $s2 = "javascript:" nocase ascii wide
        $s3 = "onerror=" nocase ascii wide
        $s4 = "onload=" nocase ascii wide
        $s5 = "<svg" nocase ascii wide
        $s6 = "document.cookie" nocase ascii wide
        $s7 = "document.location" nocase ascii wide
        $enc1 = "%3Cscript" nocase ascii wide

    condition:
        (2 of ($s*)) or $enc1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75684 Adobe Connect Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Adobe"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"</script"; nocase; reference:cve,2026-75684; classtype:web-application-attack; sid:202675684; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST" and
    url.path != null and
    http.request.body.content : ("<script" or "onerror=" or "javascript:" or "<svg")]
  [network where network.protocol == "http" and http.request.method == "POST" and
    http.request.body.content : ("<script" or "</script" or "document.cookie")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| search (method=POST OR http_method=POST)
| eval payload=coalesce(form_data, request_body, uri_query, url)
| where match(payload, "(?i)(<script|%3Cscript|javascript:|onerror=|onload=|<svg|document\.cookie)")
| table _time, src_ip, dest_host, uri_path, method, payload
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,adobe_connect,">
  <rule id="2026756" level="12">
    <if_sid>31100</if_sid>
    <id>^POST</id>
    <url>adobe</url>
    <match>(?i)(<script|%3Cscript|javascript:|onerror=|onload=|<svg)</match>
    <description>CVE-2026-75684: Possible Adobe Connect stored XSS injection attempt detected in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_75684,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence exists from any tracked source, and Adobe has not been confirmed to have released a fix through the data available for this report. There is no identified vendor fix or affected-version range. Treat the deployment as unpatched until Adobe publishes an advisory.

1. Immediate mitigations:

• Deploy a web application firewall (WAF) or reverse proxy in front of Adobe Connect and enable rules that neutralize XSS payloads in request bodies and query strings. This is a compensating control, not a fix.
• Constrain exposure: restrict Adobe Connect to trusted networks or VPN where operationally feasible, reducing the reachable attack surface for AV:N exploitation.
• Enable server-side input validation and output encoding where the platform permits configuration (for example, disallowing raw HTML in fields that do not require it).
• Monitor application logs and WAF telemetry for stored payload indicators and for anomalous script execution reports from users.

2. Patch/upgrade steps:

• Monitor Adobe's security advisory channel and the NVD entry for CVE-2026-75684 for a fixed version. No fixed version is currently identified.
• When a patch is released, inventory all Adobe Connect instances, test the update in a staging environment, and apply it to production. Confirm the version number against Adobe's advisory.
• After patching, identify and purge any previously stored malicious field values, since patching the rendering logic may not remove already-persisted payloads from the data store.

3. Long-term hardening:

• Enforce a Content Security Policy (CSP) with restrictive script-src directives to reduce the impact of any residual XSS.
• Apply context-aware output encoding across all user-supplied content and adopt a framework that escapes by default.
• Mark session cookies HttpOnly and Secure, and implement short session lifetimes with re-authentication to limit session-hijacking impact.
• Maintain a vulnerability management process with continuous monitoring of Adobe advisories, NVD, and CISA KEV.
• Conduct periodic application security testing, including authenticated and unauthenticated XSS testing of all form-accepting surfaces.

References

• NVD — CVE-2026-75684: https://nvd.nist.gov/vuln/detail/CVE-2026-75684
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Adobe Security Bulletins (monitor for an advisory covering CVE-2026-75684): https://helpx.adobe.com/security.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-75684 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score currently assigned for this CVE): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat actor campaigns is available for CVE-2026-75684 at the time of writing.