ncsc-2026-0391
CRITICAL CVSS 9.9 csaf_ncscnl
Description
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Timeline
- Published
- 2026-09-23 13:32 UTC
- Last Modified
- 2026-09-23
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Adobe heeft 9 kwetsbaarheden verholpen in Adobe Connect en de Adobe Connect Android Mobile App. De kwetsbaarheden zijn verholpen in Adobe Connect 12.12 en Adobe Connect Android Mobile App 4.5.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Adobe Connect, waaronder SQL-injectie, Cross-Site Scripting (XSS), onvoldoende invoervalidatie, path traversal en onvoldoende certificaatvalidatie. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 9 kwetsbaarheden zijn zeven door Adobe als kritiek aangemerkt. Succesvol misbruik kan onder meer leiden tot het uitvoeren van willekeurige code, privilege-escalatie, het uitlezen van bestanden en het omzeilen van beveiligingsmaatregelen.\n\nVan de zeven kwetsbaarheden die als kritiek zijn aangemerkt, hebben zes een CVSS-score van 9,3 of hoger. De kwetsbaarheid met kenmerk CVE-2026-75682 heeft met een CVSS-score van 9,9 de hoogste score en betreft een SQL-injectiekwetsbaarheid waarmee een laaggeprivilegieerde kwaadwillende willekeurige code kan uitvoeren. \n\nDe kwetsbaarheden met kenmerk CVE-2026-75684, CVE-2026-75689 en CVE-2026-75697 betreffen opgeslagen XSS-kwetsbaarheden die kunnen leiden tot privilege-escalatie. CVE-2026-75686 betreft onvoldoende invoervalidatie en CVE-2026-75698 een reflected XSS-kwetsbaarheid en succesvol misbruik kan leiden tot het uitvoeren van willekeurige code. Voor deze vijf kwetsbaarheden is geen authenticatie vereist, maar wel gebruikersinteractie. \n\nCVE-2026-34689 betreft een path-traversalkwetsbaarheid met een CVSS-score van 8,6 waarmee een niet-geauthenticeerde kwaadwillende zonder gebruikersinteractie bestanden kan uitlezen.\n\nAdobe meldt niet op de hoogte te zijn van actief misbruik van de kwetsbaarheden.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Adobe heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Gebruikers van Adobe Connect wordt geadviseerd te updaten naar versie 12.12. Voor de Adobe Connect Android Mobile App is versie 4.5 beschikbaar. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"title": "CWE-89"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://helpx.adobe.com/security/products/connect/apsb26-150.html"
}
],
"title": "Kwetsbaarheden verholpen in Adobe Connect en Adobe Connect Android Mobile App",
"tracking": {
"current_release_date": "2026-09-23T13:32:29.748002Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0391",
"initial_release_date": "2026-09-23T13:32:29.748002Z",
"revision_history": [
{
"date": "2026-09-23T13:32:29.748002Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Adobe Connect"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Adobe Connect Android Mobile App"
}
],
"category": "vendor",
"name": "Adobe"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-75682",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"title": "CWE-89"
},
{
"category": "description",
"text": "Adobe Connect contains a SQL Injection vulnerability enabling low-privileged attackers to execute arbitrary SQL commands and potentially escalate privileges or control user accounts without user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75682 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75682.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75682"
},
{
"cve": "CVE-2026-75684",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "description",
"text": "Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability that permits attackers to inject malicious scripts into form fields, enabling execution of arbitrary JavaScript in users' browsers and potential account or session compromise.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75684 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75684.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75684"
},
{
"cve": "CVE-2026-75686",
"notes": [
{
"category": "description",
"text": "Adobe Connect contains an Improper Input Validation vulnerability that enables arbitrary code execution when a user interacts with a malicious URL or compromised web page, leading to a change of scope.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75686 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75686.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75686"
},
{
"cve": "CVE-2026-75689",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "description",
"text": "Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability that permits attackers to inject malicious scripts into form fields, enabling execution of arbitrary JavaScript in users' browsers and potential account or session compromise.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75689 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75689.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75689"
},
{
"cve": "CVE-2026-75697",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "description",
"text": "Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability that permits attackers to inject malicious scripts into form fields, enabling execution of arbitrary JavaScript in users' browsers and potential account or session compromise.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75697 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75697.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75697"
},
{
"cve": "CVE-2026-75698",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "description",
"text": "Adobe Connect contains a reflected Cross-Site Scripting (XSS) vulnerability exploitable via crafted URLs or compromised web pages, potentially allowing attackers to execute malicious scripts and gain elevated access through user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-75698 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-75698.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-75698"
},
{
"cve": "CVE-2026-34689",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"title": "CWE-22"
},
{
"category": "description",
"text": "Adobe Connect contains a Path Traversal vulnerability enabling attackers to read arbitrary system files without user interaction, potentially exposing sensitive data beyond intended access controls.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-34689 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34689.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-34689"
},
{
"cve": "CVE-2026-83964",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "Adobe Connect contains an Improper Certificate Validation vulnerability that enables attackers to disclose sensitive memory without any user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83964 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83964.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-83964"
},
{
"cve": "CVE-2026-48361",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"title": "CWE-79"
},
{
"category": "description",
"text": "Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject and execute malicious JavaScript through vulnerable form fields in users' browsers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-48361 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48361.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-48361"
}
]
}