A flaw in Adobe Connect allows an attacker to inject arbitrary SQL commands by unsafely incorporating user input into database queries. This improper neutralization of special elements can lead to arbitrary code execution in the context of the current user, potentially enabling privilege escalation or full control of the victim session. The impact is significant because a low‑privileged attacker could exploit the vulnerability without needing any user interaction.

Adobe Connect and the Adobe Connect Android Mobile App are affected. No specific version numbers are listed in the available data, so all installations should be examined for the presence of mitigations or updates the vendor provides.

The CVSS score of 9.9 highlights a high severity, and the EPSS score is unavailable. The vulnerability is not yet cataloged in CISA’s KEV database. Based on the description, it is inferred that the attack vector is remote via the web interface of Adobe Connect, since exploitation does not require user interaction. The scope change indicates the attacker can raise privileges beyond the original user context, suggesting a potential for widespread compromise.