Adobe Patches Critical Vulnerability in Connect Collaboration Suite

Adobe has issued patches addressing more than 35 vulnerabilities across its products, including a critical flaw in the Connect collaboration suite tracked as CVE-2025-49553 with a CVSS score of 9.3, described as a cross-site scripting issue that could allow arbitrary code execution.

The fix for this defect is included in Adobe Connect version 12.10, rolled out on Windows and macOS, alongside patches for two other flaws, including a high-severity XSS issue in Commerce and Magento Open Source that could lead to privilege escalation. In addition, updates resolve a high-severity security bypass and three medium-severity defects capable of code execution, privilege escalation, and protection bypass.

High-severity vulnerabilities with potential for arbitrary code execution, each with a CVSS of 7.8, were addressed across Substance 3D Stager, Dimension, Illustrator, FrameMaker, Substance 3D Modeler, Substance 3D Viewer, Animate, and Bridge, which Adobe lists as critical rather than merely high. The company notes it is not aware of these issues being exploited in the wild, but users are urged to apply the patches promptly, with further details available on Adobe’s PSIRT page, according to Adobe’s PSIRT page.