Adobe Connect versions 2025.3, 12.10 and earlier contain a reflected Cross‑Site Scripting flaw that allows an attacker to inject arbitrary script code into responses. When a victim clicks a crafted URL or visits a compromised page, the script executes in the victim’s browser, potentially enabling the attacker to hijack the user’s session, steal credentials, or execute privileged actions. The flaw is identified as CWE‑79 and the change in scope signals that all users of affected installations are at risk.

Adobe Connect product versions 2025.3, 12.10, and all earlier releases are impacted. The vulnerability applies to the web‑based application and the desktop clients for macOS and Windows as listed in the affected CPE set.

The CVSS score of 9.3 indicates a high severity. Although the EPSS score is less than 1%, the lack of a KEV listing does not reduce the risk because the vulnerability still requires user interaction, which is a common entry point for XSS attacks. Attackers must convince a victim to visit a maliciously crafted link or compromised page, but once executed the exploit can grant inflated privileges or full account takeover. The scope change underscores that all users of the affected installations would be exposed if the vulnerability is exploited.