Stored XSS as a Privilege Ladder: CVE-2026-75684, CVE-2026-75689 and CVE-2026-75697 in Adobe Connect
Three of the nine flaws in the Adobe Connect September 2026 release share a shape: stored cross-site scripting that Adobe links to privilege escalation. CVE-2026-75684, CVE-2026-75689 and CVE-2026-75697 each carry a CVSS v3 score of 9.3, and none of them requires authentication.
Stored XSS is often filed mentally as a website problem. In a platform that hosts meetings administered through a browser console, it is closer to a privilege escalation primitive.
Why stored XSS is different from reflected XSS
A reflected flaw fires once, against the person who follows a crafted link. A stored flaw persists in the application and waits. Whoever loads the affected page later receives the payload, and the attacker does not need to know when that will be.
That distinction is the reason a stored XSS issue in an administrative interface is treated as severe rather than cosmetic. The interesting asset in a Connect deployment is not the attacker's own session. It is the session of somebody who can change settings, invite participants, publish content or manage accounts.
The same weakness appearing in three places
Adobe lists three separate CVEs because the vulnerable paths are distinct. The shared characteristics are the ones that matter for defenders.
| CVE | Score | Type | Authentication | User interaction |
|---|---|---|---|---|
| CVE-2026-75684 | 9.3 | Stored XSS leading to privilege escalation | Not required | Required |
| CVE-2026-75689 | 9.3 | Stored XSS leading to privilege escalation | Not required | Required |
| CVE-2026-75697 | 9.3 | Stored XSS leading to privilege escalation | Not required | Required |
Beyond these three, the release also fixes CVE-2026-75686 for improper input validation and CVE-2026-75698 for reflected XSS. Adobe associates both with arbitrary code execution, and neither requires authentication, though both require user interaction.
What privilege escalation means here
A browser session in an administrative console carries whatever the signed-in user can do. If a stored payload executes in that session, it acts with that user's authority. The escalation is therefore not a memory-corruption trick; it is the ordinary consequence of running attacker-controlled script in a privileged context.
Two practical implications follow. First, the population at risk includes administrators who never open unusual links, because the payload is already stored. Second, the value of the exploit depends on who eventually visits the page, which makes the flaw unpredictable rather than harmless.
Mitigations beyond patching
The definitive fix is Adobe Connect 12.12 with the Android client at 4.5. Until the upgrade is complete, defensive steps fall into familiar categories.
- Restrict who can post content that other users will later view.
- Treat administrative consoles as privileged network segments rather than general-purpose web applications.
- Apply a content security policy that limits inline script execution where the deployment supports it.
- Alert on anomalous administrative actions following the viewing of user-supplied content.
These measures reduce the chance that a stored payload reaches a privileged session. They do not substitute for the vendor fix.
Exposure context
A ZoomEye query for app="Adobe Connect" returned 23,660 matching instances at the time of the query. The count is a fingerprint measurement, not evidence that specific systems are vulnerable, but it does indicate how broadly the product is deployed on reachable networks.
References
- Adobe security bulletin APSB26-150: https://helpx.adobe.com/security/products/connect/apsb26-150.html
- NCSC-NL advisory NCSC-2026-0391: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0391
- ZoomEye search for
app="Adobe Connect": https://www.zoomeye.ai/searchResult?q=YXBwPSJBZG9iZSBDb25uZWN0Ig%3D%3D
