# CVE-2026-121904: Adobe Connect stored cross-site scripting vulnerability

Source: https://junglewise.ai/threats/cve-2026-121904-adobe-connect-is-affected-by-a-stored-cross-site-scripting-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-121904 · Severity: critical · CVSS 9.6 · Published 2026-11-10

Adobe Connect, a web conferencing and collaboration platform used by organizations for meetings and training, contains a stored cross-site scripting (XSS) vulnerability in form fields. A low-privileged user can inject malicious scripts that execute in other users' browsers, potentially allowing account takeover or unauthorized access to sessions and data.

Technologies: [Adobe Connect](https://junglewise.ai/threats/technologies/adobe-connect). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-121904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121904 being exploited in the wild.

**How severe is CVE-2026-121904?** Critical severity, with a CVSS score of 9.6, published 10 November 2026.

**Which products and versions are affected?** Adobe Connect 12.12 and earlier.

**Is there a fix for CVE-2026-121904?** Yes: fixed in 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121904 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-121904?** Check whether you run Adobe Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## Technical details

A stored XSS vulnerability (CWE-79) in Adobe Connect allows a low-privileged attacker to inject malicious JavaScript into form fields that persists server-side. When other users browse to pages containing the vulnerable field, the JavaScript executes in their browsers with their privileges, enabling privilege escalation and session compromise. The vulnerability requires low-level user authentication but no victim interaction beyond normal use of the platform.

## Affected products

- Adobe Connect 12.12 and earlier

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.adobe.com/trust/security/products/connect/apsb26-191.html](https://www.adobe.com/trust/security/products/connect/apsb26-191.html)

## Related threats

- [Adobe Connect stored cross-site scripting in form fields](https://junglewise.ai/threats/cve-2026-122102-adobe-connect-is-affected-by-a-stored-cross-site-scripting-xss)
- [Adobe Connect incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-121913-adobe-connect-is-affected-by-an-incorrect-authorization)
- [Adobe Connect cross-site scripting in form fields](https://junglewise.ai/threats/cve-2026-121912-adobe-connect-is-affected-by-a-cross-site-scripting-xss)
- [Adobe Connect multiple critical vulnerabilities](https://junglewise.ai/threats/cve-2026-121910-adobe-connect-is-affected-by-a-cross-site-scripting-xss)
- [Adobe Connect SQL injection](https://junglewise.ai/threats/cve-2026-121908-adobe-connect-is-affected-by-an-improper-neutralization-of)