Adobe Connect CVE-2025-49553

Exploitation requires that a victim who is (or can be) a Connect user navigate to an attacker-crafted web page or crafted URL that triggers the DOM-based XSS sink in Adobe Connect 12.9 or earlier; this user-interaction requirement (UI:R) is the primary limiting factor and means the attack cannot succeed purely server-side or without luring a victim. No authentication is required of the attacker (PR:N), and the attack is network-delivered, but the payoff (session takeover) is realized only against an active/authenticated Connect victim session, so the practical impact depends on targeting logged-in users. No special non-default server configuration is cited as a prerequisite in the description.

Signals are mixed and point to a moderate real-world priority rather than an emergency. The CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) is inflated primarily by the scope change (S:C) and dual high confidentiality/integrity impact tied to session takeover; critically, exploitation is NOT zero-click - it requires user interaction (UI:R), as the victim must navigate to an attacker-crafted web page. This user-interaction gate materially lowers practical risk versus a true unauthenticated-RCE-style 9.3. Corroborating this, the EPSS score is low at 0.53% (43rd percentile), indicating no statistical signal of imminent mass exploitation. The vulnerability is NOT on the CISA KEV list and there is no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. No SSVC decision data was provided in the input. In short: this is a legitimate high-severity client-side flaw worth patching promptly, but the high CVSS is driven by scope/impact math while the required user interaction and low EPSS suggest it is not currently a drop-everything, widely-exploited threat. The PR:N (unauthenticated) and C:H/I:H claims are vendor-reported via Adobe PSIRT and consistent with a DOM XSS leading to session hijacking.

An attacker crafts a malicious web page (or a link to a crafted URL) that triggers the DOM-based XSS sink in Adobe Connect and sends it to a target Connect user via phishing or a watering-hole. When the victim navigates to the page, attacker-controlled JavaScript executes in the victim's browser in the Connect origin, allowing session cookie/token theft and session takeover. No public exploit code is identified at time of analysis, and success depends on the victim following the link (UI:R).