External risk intelligence

Adobe Connect DOM-based Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-49553

Adobe Connect is a web conferencing and virtual classroom platform designed to be accessed via the internet by external users. As a web-based application serving remote participants, its core functionality involves public-facing or externally reachable web endpoints, making it a common internet-facing service.

Cross-site Scripting

Adobe Connect

before 12.10

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a cross-site scripting vulnerability in Adobe Connect versions prior to 12.10. An attacker could exploit this by tricking a user into visiting a malicious web page, potentially leading to the takeover of user sessions.

Malicious scripts could run in user browsers.
Session takeover can significantly impact data confidentiality and integrity.
Confirm relevance and exposure to affected Adobe Connect users.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then leverages a vulnerability in Adobe Connect to run harmful scripts within the user's browser. This could allow the attacker to take over the user's session.

Entry Condition: User visits a crafted webpage.
Trigger Point: Vulnerable component within Adobe Connect.
Resulting Risk: Session takeover, impacting confidentiality and integrity.

Live Threat

Current exploitation, exposure, and threat context

A DOM-based Cross-Site Scripting vulnerability in Adobe Connect could allow an attacker to run malicious scripts in a user's browser when they visit a specially crafted web page. This could lead to session takeover, potentially impacting the confidentiality and integrity of user data.

User sessions could be compromised.
Victims must interact with a malicious web page.
Confidentiality and integrity of user data may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This DOM-based XSS vulnerability in Adobe Connect requires understanding who owns the Adobe Connect deployment and how it's integrated into your environment. The first step is to locate all instances of Adobe Connect, determine their exposure, and identify the business-criticality and responsible owner for each. This will inform a risk-based remediation plan, potentially involving vendor coordination or temporary mitigation.

Ownership resides with the Adobe Connect application owner.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect and how is it used?

Adobe Connect is a web conferencing and virtual classroom software platform. It enables organizations to host live training sessions, webinars, and collaborative meetings, allowing participants to interact in real-time through a web browser. Because it supports remote learners and distributed teams, the software is designed to be accessible via the internet, often serving as a central hub for organizational communication and digital learning environments.

What is the DOM-based XSS vulnerability in CVE-2025-49553?

This vulnerability is classified as CWE-79, or Improper Neutralization of Input During Web Page Generation. In plain terms, it means the application processes data in an unsafe way within the user's browser. Because the issue is 'DOM-based,' the malicious script executes by manipulating the Document Object Model of the web page directly, allowing an attacker to run unauthorized code in the context of the user's active session.

How is this vulnerability triggered?

To trigger the bug, a user must be convinced to navigate to a specifically crafted web page designed to exploit the software's script-processing flaw. It is not enough for an attacker to simply know the address of an Adobe Connect server. The vulnerability does not trigger if a user avoids clicking malicious links or navigating to untrusted, prepared external websites that are designed to interact with the application.

Why does Halo Surface Signal categorize this as internet-facing?

Halo Surface Signal identifies Adobe Connect as an internet-facing service because its core functionality—hosting virtual meetings and classrooms—relies on being reachable by remote participants over the web. Since these web endpoints are intended to be accessed from outside the internal corporate network by various users, the platform effectively operates as a public-facing service, which increases the likelihood of exposure to external threats.

What should I do if I manage Adobe Connect?

Your first step is to perform an inventory of all your Adobe Connect deployments to understand which instances are currently active and who is responsible for their maintenance. Coordinate with the designated application owners to verify their current version, as the vulnerability affects all versions prior to 12.10. Once located, prioritize these instances based on their business use and internet reachability to plan and execute the necessary vendor updates.

References

helpx.adobe.com/security/products/connect/apsb25-70.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.