Adobe Connect versions 12.9 and earlier suffer from a DOM‑based Cross‑Site Scripting (XSS) flaw. The vulnerability allows an attacker with high privileges to embed malicious scripts that run in a victim’s browser when the victim visits a crafted web page. Successful exploitation can lead to session hijacking, and because the flaw changes application scope, it can compromise confidentiality and integrity at a high level.

Affected systems are installations of Adobe Connect through version 12.9 on macOS and Windows platforms. The vulnerability is present in all builds before the release associated with Adobe's security bulletin APSB25‑70.

The CVSS score of 8.1 indicates a high severity. However, the EPSS of less than 1% suggests exploitation is unlikely under normal circumstances, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires user interaction – the victim must open a specially crafted page – meaning the attack vector is browser‑based XSS. Because the vulnerability alters the application scope, it permits an attacker to gain elevated privileges within the Adobe Connect environment, potentially leading to session takeover and data compromise.