CVE-2025-55888 is a Cross-Site Scripting (XSS) vulnerability in the Ajax transaction manager endpoint of ARD. The vulnerability arises because the accountName field in the Ajax response is not properly sanitized or encoded before rendering. An attacker who can intercept the Ajax response can inject malicious JavaScript code, which executes in the context of the user's browser. This can lead to client-side impacts such as session hijacking and cookie theft. The CVSS 3.1 base score is 7.3 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or remediation information is provided, and no known exploits have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of affected users' browsers. This can result in session hijacking, cookie theft, and potentially other malicious actions that compromise user confidentiality, integrity, and availability. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risks by restricting access to the affected Ajax endpoint or employing web application firewalls that can detect and block XSS payloads. Avoid exposing sensitive data in the accountName field if possible. Monitor vendor communications for updates on patches or official mitigations.