CVE-2026-34617 is a Cross-Site Scripting (XSS) vulnerability in Adobe Connect versions 2025.3, 12.10, and earlier. This vulnerability allows an attacker with low privileges to inject malicious scripts into web pages viewed by other users. Successful exploitation requires user interaction and can result in privilege escalation by changing the security scope, potentially compromising the victim's account or session. The CVSS 3.1 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, low privileges required, and user interaction needed. The vulnerability impacts confidentiality and integrity but does not affect availability. No vendor-provided patch or official remediation level is currently documented.

If exploited, this XSS vulnerability could allow attackers to escalate privileges by executing malicious scripts in the context of a victim's session, potentially leading to unauthorized access or control over the victim's Adobe Connect account. The confidentiality and integrity of user data and sessions are at risk. Availability is not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution by avoiding clicking on suspicious links or interacting with untrusted content within Adobe Connect. Monitor Adobe's security advisories for updates on patches or mitigations.