Adobe Connect vulnerabilities

83 CVEs affecting Adobe Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83964, published 2026-09-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-22232, published 2023-02-17. Medium severity, CVSS 5.3. EPSS: 83.4% chance of exploitation in the next 30 days. Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage…
CVE-2018-12804, published 2018-07-20. Critical severity, CVSS 9.8. EPSS: 11.1% chance of exploitation in the next 30 days. Adobe Connect versions 9.7.5 and earlier have an Authentication Bypass vulnerability. Successful exploitation could lead to session hijacking.
CVE-2018-4994, published 2018-05-19. High severity, CVSS 7.5. EPSS: 8.1% chance of exploitation in the next 30 days. Adobe Connect versions 9.7.5 and earlier have an exploitable Authentication Bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-4923, published 2018-05-19. Critical severity, CVSS 9.1. EPSS: 8% chance of exploitation in the next 30 days. Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion.
CVE-2016-7851, published 2016-11-08. Medium severity, CVSS 6.1. EPSS: 7% chance of exploitation in the next 30 days. Adobe Connect version 9.5.6 and earlier does not adequately validate input in the events registration module. This vulnerability could be exploited in cross-site scripting attacks.
CVE-2017-3101, published 2017-07-17. High severity, CVSS 7.5. EPSS: 5.6% chance of exploitation in the next 30 days. Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. Successful exploitation could lead to a clickjacking attack.
CVE-2017-11291, published 2017-12-09. Critical severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days. An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery (SSRF) vulnerability exists that could be abused to bypass network access controls.
CVE-2016-0949, published 2016-02-10. Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days. Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL.
CVE-2018-12805, published 2018-07-20. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2021-21085, published 2021-03-12. High severity, CVSS 7.8. EPSS: 3.9% chance of exploitation in the next 30 days. Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online…

Latest

CVE-2026-83964, published 2026-09-22. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive…
CVE-2026-75698, published 2026-09-22. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining…
CVE-2026-75697, published 2026-09-22. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
CVE-2026-75689, published 2026-09-22. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
CVE-2026-75686, published 2026-09-22. Critical severity, CVSS 9.3. EPSS: 0.6% chance of exploitation in the next 30 days. Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability…
CVE-2026-75684, published 2026-09-22. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
CVE-2026-75682, published 2026-09-22. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the…
CVE-2026-48361, published 2026-09-22. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be…
CVE-2026-34689, published 2026-09-22. High severity, CVSS 8.6. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit…
CVE-2026-34617, published 2026-04-14. High severity, CVSS 8.7. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this…