CVE-2025-49553 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 12.9 and earlier across Windows and macOS platforms. This vulnerability, rated 9.3 CRITICAL, allows an unauthenticated attacker to execute malicious scripts in a victim's browser if they navigate to a crafted web page, leading to high confidentiality and integrity impact, including session takeover. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating high awareness. Organizations should implement WAFs, user training, CSP, and network segmentation as mitigation strategies until a patch is available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.10CPE matchmatch criteria | cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.