Adobe Connect is affected by a high-severity Cross-Site Scripting vulnerability that permits low-privileged attackers to escalate privileges and compromise user sessions.

The application is susceptible to CWE-79 (Cross-Site Scripting), which allows an authenticated, low-privileged attacker to inject malicious scripts into web pages. Successful exploitation requires user interaction, where a victim must access a crafted URL or compromised page, leading to potential session hijacking or account control.

The vulnerability carries a CVSS score of 8.7, reflecting its potential for total impact on confidentiality and integrity. If exploited, an attacker could gain unauthorized administrative or elevated access to the platform, leading to potential data exfiltration, unauthorized modification of meeting content, or complete compromise of user accounts. Such an event would result in significant operational disruption and loss of trust in secure communications.

Immediate Action: Update Adobe Connect to version 12.11 or later and the Adobe Connect Desktop Application to version 2025.9 or later to fully remediate the flaw.

Proactive Monitoring: Review web server and application logs for suspicious URL patterns or unexpected script execution attempts originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious script injection patterns or suspicious URL parameters that may facilitate XSS attacks.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the potential for privilege escalation, administrators must prioritize the deployment of the vendor-provided patches. Failure to update the software leaves the organization exposed to session-based attacks that could bypass existing security controls. Apply the recommended versions immediately to ensure the security of your Adobe Connect environment.