CVE-2026-34617

CVE-2026-34617 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 2025.3, 12.10 and earlier that enables privilege escalation through injection of malicious scripts into web pages. The vulnerability requires user interaction, as victims must visit a crafted URL or engage with a compromised page, but can result in unauthorized account access or session hijacking even for low-privileged attackers. From a severity perspective, the vulnerability carries a CVSS 3.1 score of 8.7 (HIGH) with a network-based attack vector, low complexity, and potential for high confidentiality and integrity impact with changed scope. The EPSS score of 0.0004 indicates minimal current exploitation likelihood, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog nor tracked on active threat lists. Organizations running affected Adobe Connect versions should prioritize patching while recognizing that active exploitation remains unlikely based on current threat intelligence.