Adobe Connect Cross-Site Scripting Vulnerability Allowing Privilege Escalation

A Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Connect versions 2025.3, 12.10 and earlier. This vulnerability allows a low-privileged attacker to inject malicious scripts into a web page, potentially leading to privilege escalation by gaining elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or engaging with a compromised web page.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing an attacker to gain elevated access or control over a victim's account or session.

Remediation

Users are advised to update to Adobe Connect version 12.11 or the Adobe Connect Desktop Application version 2025.9. Release notes for these updates are available on the Adobe website.