Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.
Conclusion & alert: CVE-2025-49553 is rated Moderate Risk (44.4/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.07%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-12 | 0.18% | 0.07% | -0.12% |
| 2 | 2026-02-13 | 0.10% | 0.18% | +0.09% |
| 3 | 2025-10-15 | — | 0.10% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.3 | 3.1 | CRITICAL |
|
2.8 | 5.8 | [email protected] |
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/connect/apsb25-70.html | Vendor Advisory |