The vulnerability is a reflected cross‑site scripting flaw that allows an attacker to embed malicious JavaScript in a web page that a victim visits. When a victim clicks a crafted URL, the script runs with the privileges of the user’s browser session, potentially enabling information theft, session hijack, or defacement. The severity assessment notes a change of scope in the CVSS calculation, indicating that an attacker could gain privileges beyond the original context.

Adobe Connect deployments running version 2025.3, 12.10 or any earlier release are affected. The issue applies to all installations of Adobe Connect that have not been updated beyond these versions.

The CVSS score is 9.3, indicating high severity. No EPSS score is available, but the lack of mitigation in the public notes suggests the exploit is likely to be attempted once disclosed. The attack vector is remote user‑initiated via a malicious link, requiring only that a victim visit the vulnerable page. Because the flaw is reflected and does not require authentication or privileged access, the exposure to a large user base is substantial.