Review reviewCritical

CVE-2026-34615

Adobe Adobe Connect, connect, macos

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS: 9.3
EPSS: 0.63%
CISA KEV: Not listed
Published: 2026.04.15

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.63%

Technical severityCVSS 9.3

Vulnerability overview

Affected product and versions

Product: Adobe Adobe Connect, connect, macos
Affected versions: <= 12.10, < 12.11, <= 2025.3, < 2025.9.15
Fixed versions: 12.11, 2025.9.15

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Adobe Adobe Connect, connect, macos and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE: CWE-502