Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. The scope of the vulnerability is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-34615 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted data to the affected Adobe Connect application over the network. Since the vulnerability does not require user interaction, it can be executed remotely, allowing the attacker to execute arbitrary code in the context of the current user, potentially leading to unauthorized access and control over the affected system.
Affected Products
- Adobe Connect 2025.3: Affected by the deserialization vulnerability allowing arbitrary code execution.
- Adobe Connect 12.10: Also vulnerable to the same issue, enabling potential exploitation without user interaction.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Adobe Connect as soon as possible. Adobe has released patches that address this issue, and applying these updates will help protect against potential exploitation. Additionally, organizations should implement network security measures to monitor and restrict unauthorized access to the application.