CVE-2025-49552 is a DOM-based XSS vulnerability affecting Adobe Connect versions 12.9 and earlier. It allows an attacker with high privileges to inject and execute malicious scripts in the context of a victim's browser when the victim visits a specially crafted web page. The vulnerability requires user interaction and can result in session takeover, thereby compromising confidentiality and integrity. The CVSS 3.1 base score is 8.1, reflecting high severity with network attack vector, low attack complexity, required privileges at a high level, and user interaction. The vulnerability changes the security scope, indicating impact beyond the vulnerable component. No known exploits in the wild or patch information is currently available.

The vulnerability enables attackers to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking. This compromises the confidentiality and integrity of user sessions within Adobe Connect. The attack requires user interaction and a high-privileged attacker, but successful exploitation can result in significant security impact. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and content within Adobe Connect environments, especially from untrusted sources. Monitor Adobe's official channels for updates and patches addressing this vulnerability.