Adobe Connect September 2026 patches close three unauthenticated stored XSS flaws rated 9.3

Adobe's September 2026 security release for Connect addresses nine vulnerabilities, and three of them stand out: stored cross-site scripting flaws that Adobe links directly to privilege escalation. According to a security analysis published on dev.to, each of the three carries a CVSS v3 base score of 9.3, and an attacker needs no authentication to plant the payload.

Three CVEs, one pattern

The write-up identifies the flaws as CVE-2026-75684, CVE-2026-75689 and CVE-2026-75697. Adobe assigned separate identifiers because the vulnerable code paths differ, but the security-relevant properties are identical in each case: a stored XSS issue classified as leading to privilege escalation, a 9.3 severity score, no authentication requirement, and user interaction needed for the payload to run.

The stored nature is what elevates these beyond an ordinary scripting bug. A reflected XSS flaw fires once, against whoever follows a maliciously crafted link. A stored flaw is saved inside the application and executes later, whenever someone loads the affected page — no phishing link required.

Why an admin console changes the severity

Connect is administered through a browser console, and that is where stored XSS stops behaving like a cosmetic web defect and starts working as an escalation tool. The valuable session is not the attacker's own; it belongs to whoever can adjust settings, manage accounts, invite participants or publish content. Script running inside that browser context acts with that user's full authority.

The dev.to analysis draws two practical conclusions from this. First, administrators are exposed even if they never click anything unusual, because the payload is already sitting on a page they will eventually visit. Second, the eventual impact depends on who loads the page, which makes the flaws unpredictable rather than minor.

Two more flaws tied to code execution

The same release also patches CVE-2026-75686, an improper input validation issue, and CVE-2026-75698, a reflected XSS flaw. Adobe associates both with arbitrary code execution, the write-up notes, and while neither requires authentication, both depend on user interaction.

Patching and interim measures

The fixed versions are Adobe Connect 12.12 together with the Android client at 4.5, according to the analysis. For deployments that cannot upgrade immediately, it recommends four stopgaps: restricting who can post content that other users will later see, treating the administrative console as a privileged network segment rather than a general-purpose web application, applying a content security policy that limits inline script where the deployment supports it, and raising alerts when anomalous administrative actions follow the display of user-supplied content. These measures reduce the chance a payload lands in a privileged session but do not replace the vendor's patch.

Broad deployment, uncertain exposure

A ZoomEye fingerprint search for Adobe Connect returned 23,660 matching instances at the time of the query. The write-up is careful to note that this count shows how widely the product is deployed on reachable networks, not that those specific systems are vulnerable. The findings correspond to Adobe security bulletin APSB26-150 and are tracked by the Dutch cybersecurity agency NCSC-NL in advisory NCSC-2026-0391.

Why it matters

Three unauthenticated flaws rated 9.3 in a browser-administered meeting platform combine persistence, privileged victims and no credential requirement — precisely the mix that makes a bug attractive to real attackers. Connect administrators should treat this month's release as a priority rather than routine housekeeping, and organizations running older versions on internet-facing hosts have the most urgent reason to move.