CVE-2025-49553

Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/connect/apsb25-70.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 12.9 y anteriores de Adobe Connect están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante para ejecutar scripts maliciosos en el navegador de una víctima. La explotación de este problema requiere interacción del usuario, ya que la víctima debe navegar a una página web manipulada. Un atacante exitoso puede abusar de esto para lograr la toma de control de la sesión, aumentando el impacto en la confidencialidad y la integridad a un nivel alto. El alcance ha cambiado.

Information

Published : 2025-10-14 22:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-49553

Mitre link : CVE-2025-49553

CVE.ORG link : CVE-2025-49553

JSON object : View

Products Affected

adobe

connect

microsoft

windows

apple

macos

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-49553", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49553", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-21T03:55:30.867706Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Connect", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.9"}], "defaultStatus": "affected"}]}], "published": "2025-10-14T22:15:37.860", "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb25-70.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed."}, {"lang": "es", "value": "Las versiones 12.9 y anteriores de Adobe Connect est\u00e1n afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podr\u00eda ser explotada por un atacante para ejecutar scripts maliciosos en el navegador de una v\u00edctima. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, ya que la v\u00edctima debe navegar a una p\u00e1gina web manipulada. Un atacante exitoso puede abusar de esto para lograr la toma de control de la sesi\u00f3n, aumentando el impacto en la confidencialidad y la integridad a un nivel alto. El alcance ha cambiado."}], "lastModified": "2026-10-08T12:10:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "FE8202C5-1060-4C83-B5D6-ECB75864C63F", "versionEndExcluding": "12.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}