Adobe Connect versions 2025.3, 12.10 and earlier contain a reflected cross‑site scripting flaw that allows a low‑privileged attacker to inject malicious scripts into a web page. If executed, the script can elevate an attacker’s access or control over the victim’s account or session. The vulnerability is tied to CWE‑79 and changes the scope of the affected system.

The flaw affects Adobe Connect from versions 2025.3, 12.10 and all previous releases. Users running any of these releases are vulnerable to XSS and the associated privilege escalation risk.

The CVSS score of 8.7 indicates a high severity. Attack requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised page. EPSS data is not available, but the flaw is not listed in CISA’s KEV catalog. Because the vulnerability changes scope, an attacker with a low‑privilege account can reach higher‑privilege levels once the script runs. The likely vector is a web‑based attack delivered through the Adobe Connect interface.