Adobe Connect versions 12.9 and earlier contain an Open Redirect vulnerability that allows an attacker to direct a victim to an external, untrusted website. The flaw is triggered by clicking a crafted link, meaning exploitation requires user interaction. Once redirected, the user may be exposed to phishing, drive‑by downloads, or other malicious payloads.

Products affected are Adobe Connect releases 12.9 and earlier. The vulnerability impacts all supported operating systems where those versions run, including macOS and Windows; however the product version is the primary factor.

The CVSS score of 4.3 classifies this flaw as low severity. EPSS indicates a very low exploitation probability (<1%). It is not listed in the CISA KEV catalog. Because the attack requires a user click and a malicious URL, the risk is primarily that an attacker could use the redirect in phishing or social‑engineering attacks. Without a direct remote code execution or privilege escalation vector, the impact is limited to user convenience and potential credential theft once the victim follows the redirection.