Adobe Connect is vulnerable to a reflected Cross‑Site Scripting flaw that enables an attacker to embed malicious scripts within a web page. By delivering a specially crafted URL, the compromised script could run in the victim’s browser, potentially escalating privileges or hijacking the session. The weakness is an input validation flaw, classified as CWE‑79, with a CVSS score of 9.3 indicating high severity.

The flaw affects the Adobe Connect platform and the Adobe Connect Android Mobile App. No specific product version details are provided, so all installations that use either the web or mobile component are potentially at risk.

The high CVSS vector (9.3) combined with the requirement for user interaction means the exploit is not dormant, yet it demands a malicious link or compromised page. The EPSS score of 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV, the potential for damage if an attacker reaches a victim is significant. The attack path requires a crafted URL that reflects malicious input back into the page, making exploitation feasible from any client that can access Adobe Connect.