CVE-2026-34615

An attacker can supply crafted, untrusted data to the deserialization mechanism in Adobe Connect, resulting in the injection of malicious scripts into a web page. Exploitation requires user interaction – the victim must visit a maliciously crafted URL or interact with an infected page. Scope Changed indicates that the impacts of the attack may extend beyond the direct context of the vulnerable application.

An attacker can execute arbitrary code in the context of the current user, as well as gain elevated access or take control of the victim's account or session.

Adobe Connect should be updated to a version newer than 2025.3 / 12.10 in accordance with the vendor's recommendations published in the security bulletin APSB26-37 available at https://helpx.adobe.com/security/products/connect/apsb26-37.html

Adobe Connect in versions 2025.3, 12.10 and earlier, running on Microsoft Windows and Apple macOS (including Adobe Connect Desktop Application).