Adobe Connect is susceptible to a stored Cross-Site Scripting vulnerability that enables remote attackers to execute malicious scripts within a victim's browser session.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where an attacker can inject malicious JavaScript into form fields. The vulnerability is exploitable by unauthenticated attackers, provided they can influence the content rendered in a victim's browser.

A successful exploit allows an attacker to perform actions on behalf of the victim, such as stealing session cookies, redirecting users, or performing unauthorized administrative actions. While the CVSS score of 6.1 represents a medium severity level, the potential for session hijacking and data theft within a communication platform poses a significant risk to organizational confidentiality and integrity.

Immediate Action: Update Adobe Connect to version 12.11.1 or 12.12 and the Adobe Connect Android Mobile App to version 4.5 or later.

Proactive Monitoring: Monitor web application access logs for suspicious input patterns or unusual script tags submitted through form fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block common XSS payloads from reaching the application server.

Public Exploit Available: Unknown

Given the prevalence of Adobe Connect in remote collaboration environments, this vulnerability presents a notable risk to user security. Administrators should prioritize patching the affected software versions immediately to eliminate the underlying XSS vector and prevent potential unauthorized access to user sessions.