Adobe Connect suffers from an SQL Injection vulnerability (CWE-89) that improperly neutralizes special elements in SQL commands. This allows an attacker with low privileges to execute arbitrary SQL commands, potentially leading to arbitrary code execution within the context of the current user. The vulnerability does not require user interaction and changes the security scope, increasing the risk of privilege escalation or session compromise. The affected versions include all releases up to and including 12.11 and 4.4. The CVSS v3.1 score is 9.9, reflecting critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution as the current user, potentially allowing attackers to escalate privileges, compromise user accounts, or hijack sessions. The vulnerability affects confidentiality, integrity, and availability of the affected Adobe Connect installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Adobe Connect installations and monitor for suspicious activity related to SQL injection attempts.