What is the CVSS score of CVE-2025-49552?

CVE-2025-49552 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Connect are affected by CVE-2025-49552?

Adobe Connect versions 12.9 and earlier contain a DOM-based XSS vulnerability that enables attackers to hijack administrator sessions through crafted web pages, potentially compromising confidential…

How to fix or mitigate CVE-2025-49552?

Within 24 hours: Inventory all Adobe Connect deployments and document current versions; notify administrators of session hijacking risk and restrict their access to untrusted external links. Within 7 days: Review Adobe security advisory APSB25-70 for interim mitigations and implement available workarounds; consider restricting administrator portal access to controlled networks. Within 30 days: Upgrade to Adobe Connect version 13.0 or later (patch release per APSB25-70); implement network-level protections and monitor administrative session activity for anomalies.

Adobe Connect CVE-2025-49552

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-14 psirt@adobe.com

XSS Adobe

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 02:30 vuln.today

DescriptionCVE.org

Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Connect 12.9 and earlier enables session hijacking when high-privileged administrators interact with attacker-crafted pages. Scope change to 'C' indicates the attacker can pivot beyond the vulnerable component's security boundary, allowing privileged session takeover that impacts both confidentiality and integrity at high levels. No active exploitation confirmed per CISA KEV at time of analysis. Adobe has released security advisory APSB25-70 addressing this vulnerability.

Technical ContextAI

DOM-based XSS (CWE-79) occurs when client-side JavaScript code processes untrusted data from the DOM without proper sanitization, allowing injection of malicious scripts. Unlike reflected or stored XSS, DOM-based variants execute entirely within the browser without server-side involvement in the payload delivery. Adobe Connect is a web conferencing platform that handles sensitive meeting content and administrative functions. The CPE string cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:* indicates the vulnerability affects Adobe Connect application versions through 12.9 across all platforms. The 'Changed' scope in the CVSS vector indicates the vulnerability allows attackers to affect resources beyond the security scope of the vulnerable component itself, enabling cross-domain or cross-privilege boundary attacks that amplify impact beyond simple script execution.

RemediationAI

Apply the vendor-released patch detailed in Adobe Security Bulletin APSB25-70 at https://helpx.adobe.com/security/products/connect/apsb25-70.html. The advisory provides specific patched version information and upgrade procedures for affected Connect installations. Until patching is complete, implement these compensating controls: Restrict administrative account access to trusted networks only via firewall rules or VPN requirements, reducing exposure to network-based social engineering attacks. Implement strict Content Security Policy (CSP) headers that limit script execution sources, though this may impact legitimate Connect functionality and requires testing. Monitor administrative session activity for anomalous access patterns or session duration that could indicate hijacked credentials. Require administrative users to verify session integrity before performing sensitive operations. Note that content restrictions and CSP may interfere with Connect's legitimate collaborative features and should be validated in test environments before production deployment.