Adobe Connect is vulnerable to a stored Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into form fields. When a victim visits a page containing the compromised field, the script runs in the victim’s browser, potentially granting the attacker elevated access or full control over the victim’s account or session. The change in scope permits the exploit to affect multiple users across the platform.

Adobe Connect and the Adobe Connect Android Mobile App are affected. Specific version information is not disclosed, so any deployed instance of these products is potentially vulnerable.

The vulnerability carries a CVSS score of 9.3, indicating a critical severity. EPSS score is 1%, indicating a low but non‑zero probability of exploitation. The lack of a KEV listing does not diminish the risk. Attackers can likely exploit the stored XSS remotely by submitting malicious content through form fields, and any user who views the page will be affected. The high severity and potential for widespread impact demand prompt attention.