Adobe Connect versions 2025.3, 12.10 and earlier contain a reflected cross‑site scripting flaw. When a user opens a specially crafted URL that targets a vulnerable page, the application reflects user supplied input back into the browser without proper sanitization, allowing malicious JavaScript to run in the victim’s browser. The script executes in the context of the browser session, which can lead to manipulation of page content, interception of user actions, or redirection to malicious sites.

The affected product is Adobe Connect, specifically installations running version 2025.3, 12.10, or any earlier release. Administrators should verify the exact version and refer to Adobe’s security advisory for guidance on updates.

The CVSS base score of 6.1 indicates moderate severity, and the change of scope signals that the vulnerability could potentially affect additional components beyond the initial target. Exploitation requires the victim to follow a malicious link, which typically involves phishing or social engineering, meaning the attack vector is user interaction. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but it remains an active risk for systems lacking a patch.