Adobe Connect versions up to 2025.3 and 12.10 contain a DOM‑based Cross‑Site Scripting flaw that lets an attacker inject and run arbitrary JavaScript in a victim’s browser. The flaw is triggered when a user visits a crafted webpage or follows a specially designed link; it does not require elevated privileges beyond a normal user session. Once exploited, an attacker can hijack the browser context, steal session data, or perform other malicious actions. This vulnerability is a CWE‑79 type flaw.

The affected product is Adobe Connect. All installations running version 2025.3, 12.10, or any earlier release are vulnerable. Administrators should inventory their deployments, verify the version, and plan to upgrade to a patched release as soon as possible.

The CVSS score of 9.3 indicates a high severity. Exploitation requires user interaction, which somewhat limits spontaneous attacks, but the high impact means that a successful event can lead to serious confidentiality or integrity compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the elevated severity and potential for widespread impact justify immediate remediation.