Read the docs
TI-2026-26903 Aliases CVE-2026-34659GHSA-6cgj-r9r8-5xrr

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

Priority MEDIUM 44CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00635 50th percentileScored 2026-11-07
Fix Fixed Adobe Connect (Adobe): 12.11.1Adobe Connect Desktop Application (Adobe): 2026.3.125 (Win), 2026.01.39 (Mac)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Connectup to 12.1112.11.1Patch availableCNA
AdobeAdobe Connect Desktop Applicationup to 2025.9.15 (Win), 2025.8.157 (Mac)2026.3.125 (Win), 2026.01.39 (Mac)Patch availableCNA
  • Adobe Connect VendorAdobe Affected up to 12.11 Fixed in 12.11.1 Patch available CNA
  • Adobe Connect Desktop Application VendorAdobe Affected up to 2025.9.15 (Win), 2025.8.157 (Mac) Fixed in 2026.3.125 (Win), 2026.01.39 (Mac) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*up to 2025.8.157VulnerableAdobe
cpe:2.3:a:adobe:connect_desktop_application:2025.9.15:*:*:*:*:windows:*:*2025.9.15VulnerableAdobe
  • cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* Versions up to 2025.8.157 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:connect_desktop_application:2025.9.15:*:*:*:*:windows:*:* Versions 2025.9.15 Vulnerable ·Adobe

Remediation

  • Fix · CNA Adobe Connect (Adobe) Fixed in 12.11.1
  • Fix · CNA Adobe Connect Desktop Application (Adobe) Fixed in 2026.3.125 (Win), 2026.01.39 (Mac)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Connect, Adobe Connect Desktop Application — helpx.adobe.com/security/products/connect/apsb26-50.html

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-26904 Adobe Connect | Incorrect Authorization (CWE-863)Priority MEDIUM 42
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34659
  2. 2026-10-03 Alias added: GHSA-6cgj-r9r8-5xrr

References

Advisory 1

  • TI-2025-20060 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.6
  • TI-2026-21730 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.6
  • TI-2026-26861 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.3
  • TI-2026-26904 Adobe Connect | Incorrect Authorization (CWE-863) CVSS 3.1CRITICAL 9.3
  • TI-2026-21678 Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) CVSS 3.1CRITICAL 9.3
  • TI-2026-21677 Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) CVSS 3.1CRITICAL 9.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences