CVE-2026-21331 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe Connect versions 2025.3, 12.10 and earlier. An attacker can craft a URL referencing a vulnerable page that, when visited by a victim, causes malicious JavaScript to execute within the victim's browser context. This vulnerability impacts confidentiality and integrity by potentially allowing script execution but does not affect system availability. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. No official patch or remediation level has been published by Adobe, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to information disclosure or manipulation of data within the affected Adobe Connect session. There is no impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published by Adobe, users should exercise caution with untrusted URLs referencing Adobe Connect. Monitor Adobe's security advisories for updates and apply patches promptly once available.