Adobe Connect suffered a reflected Cross‑Site Scripting flaw that allows an attacker to insert malicious JavaScript into a vulnerable page. If a user visits a specially crafted URL, the script executes in the victim’s browser under the context of the application. This can lead to credential theft, session hijacking, defacement, and potentially other malicious actions, compromising user confidentiality and the integrity of data within the session. The weakness is identified as CWE‑79 and the attacking vector is a reflected XSS scenario.

Adobe Connect versions 2025.3, 12.10 and earlier are impacted. The vulnerability affects the product sold by Adobe as Adobe Connect.

The CVSS score of 9.3 highlights a high severity impact, and while an EPSS score is not available, the absence of an entry in the KEV catalog does not reduce the risk. The likely attack path requires an attacker to persuade a victim to click a malicious link, which is a commonly used technique for XSS exploits. Given the wide availability of the product and the popularity of web‑based meetings, the potential for exploitation is significant, and the scope change indicates that the vulnerability can affect all users of the affected installations.