An Incorrect Authorization flaw in Adobe Connect allows an attacker to inject malicious scripts into a web page and execute arbitrary code within the victim’s user context. The vulnerability enables a remote attacker to elevate privileges or gain full control over the victim’s account, effectively allowing the execution of arbitrary code. It originates from insufficient access checks when processing user-supplied input.

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected. Any deployment of these software releases is susceptible unless updated to a newer, non‑vulnerable version.

The CVSS score of 9.3 indicates a very high overall risk. The attack requires a victim to visit a maliciously crafted URL or interact with a compromised web page, so the vector is remote web-based with user interaction. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the high severity and the fact that an attacker could inject code make this vulnerability critical for any organization running affected versions of Adobe Connect.