Adobe Connect versions 2025.3, 12.10 and earlier contain a reflected cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into a page a user visits. The injected script can execute in the victim’s browser context, potentially enabling the attacker to hijack the session, steal credentials, or perform unauthorized actions on behalf of the user. This weakness is identified as CWE‑79.

All installations of Adobe Connect running version 2025.3, 12.10, or any earlier release are vulnerable. The issue applies to every deployment of the Connect web application that has not been updated beyond these releases, regardless of operating system.

The vulnerability is rated at a CVSS score of 9.3, indicating high severity. The EPSS score of < 1% shows a very low probability of exploitation at present, though the flaw could be leveraged remotely once a malicious link is discovered. The attack vector is remote user‑initiated via a crafted URL or compromised page, requiring only that a user visit the vulnerable resource. The scope is changed, so the impact potentially extends to any user with access to the affected web interface.