Read the docs
TI-2026-26904 Aliases CVE-2026-34660GHSA-2r54-572f-5p47

Adobe Connect | Incorrect Authorization (CWE-863)

Priority MEDIUM 42CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed Adobe Connect (Adobe): 12.11.1Adobe Connect Desktop Application (Adobe): 2026.3.125 (Win), 2026.01.39 (Mac)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Connectup to 12.1112.11.1Patch availableCNA
AdobeAdobe Connect Desktop Applicationup to 2025.9.15 (Win), 2025.8.157 (Mac)2026.3.125 (Win), 2026.01.39 (Mac)Patch availableCNA
  • Adobe Connect VendorAdobe Affected up to 12.11 Fixed in 12.11.1 Patch available CNA
  • Adobe Connect Desktop Application VendorAdobe Affected up to 2025.9.15 (Win), 2025.8.157 (Mac) Fixed in 2026.3.125 (Win), 2026.01.39 (Mac) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*up to 2025.8.157VulnerableAdobe
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*up to 2025.9.15VulnerableAdobe
  • cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* Versions up to 2025.8.157 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:* Versions up to 2025.9.15 Vulnerable ·Adobe

Remediation

  • Fix · CNA Adobe Connect (Adobe) Fixed in 12.11.1
  • Fix · CNA Adobe Connect Desktop Application (Adobe) Fixed in 2026.3.125 (Win), 2026.01.39 (Mac)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Connect, Adobe Connect Desktop Application — helpx.adobe.com/security/products/connect/apsb26-50.html

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-26903 Adobe Connect | Deserialization of Untrusted Data (CWE-502)Priority MEDIUM 44
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34660
  2. 2026-10-03 Alias added: GHSA-2r54-572f-5p47
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

  • TI-2025-20060 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.6
  • TI-2026-26903 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.6
  • TI-2026-21730 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.6
  • TI-2026-26861 Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVSS 3.1CRITICAL 9.3
  • TI-2026-21678 Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) CVSS 3.1CRITICAL 9.3
  • TI-2026-21677 Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) CVSS 3.1CRITICAL 9.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences