Adobe Connect versions 2025.3, 12.10 and earlier contain a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into a page. The vulnerability is triggered when a user visits a crafted URL or interacts with a compromised web page, and by exploiting it an attacker can gain elevated access or control over the victim’s account or session. This is a CWE‑79 type flaw that can be used to hijack the browser context, steal session data, or perform other malicious actions. The flaw also changes the scope of the application code, potentially expanding the attack surface for the adversary.

The affected product is Adobe Connect. Deployments running version 2025.3, 12.10, or any earlier release are vulnerable. Administrators should inventory their installations, verify the deployed version, and plan to upgrade to a patch‑provided release as soon as possible.

The CVSS score of 9.3 indicates a high severity. Exploitation requires user interaction, which somewhat limits spontaneous attacks, but a successful event can lead to serious confidentiality or integrity compromise. The EPSS score is < 1%, indicating a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, yet the elevated severity and potential for widespread impact justify immediate remediation.