Adobe Connect CVE-2025-54196

Exploitation requires that a victim user explicitly click on a crafted malicious link containing the vulnerable redirect parameter in Adobe Connect 12.9 or earlier. The attacker has no ability to force exploitation remotely - user interaction is mandatory (UI:R in CVSS vector). The vulnerability exists in default configurations with no special feature enablement or non-standard setup required. Limiting factors: successful exploitation depends entirely on social engineering users to click the link and on users not inspecting the URL before clicking. Browsers and email clients may also block or warn on suspect redirects, further limiting real-world exploitation probability.

This vulnerability presents low-to-moderate real-world risk despite network-accessible attack vector (AV:N/AC:L). The CVSS score of 4.3 reflects that exploitation requires user interaction (UI:R) to click a crafted link, and impact is limited to confidentiality (C:L) with no integrity or availability impact (I:N/A:N). EPSS data not provided, but the limited impact scope suggests low exploitation probability in practice. The attack vector is phishing-like, requiring social engineering to deceive users into clicking malicious links pointing to credential harvesting sites or malware distribution endpoints. Real-world risk depends on user awareness and email filtering controls. Not a critical prioritization issue, but represents a relevant attack surface for phishing campaigns targeting Connect users.

An attacker crafts a URL containing a malicious redirect parameter (e.g., https://company.adobeconnect.com/meeting?redirect=https://malicious-site.com/phishing) and distributes it via spear-phishing email to company employees claiming to be a meeting link. When an employee clicks the link, Adobe Connect processes and redirects them to the attacker's credential harvesting page, appearing as a legitimate login prompt. The attacker captures credentials or delivers malware, leveraging the trust users place in Adobe Connect URLs.