Critical severity · published Oct 21, 2021
CVE-2021-40719
Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are…
9.8
CVSS
3.5%
EPSS
No
On KEV
Description
Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are deserialized on an Adobe Connect server. An attacker can leverage this to execute remote code execution on the server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Connect · Adobe
through 11.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40719
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40719
Release Notes
https://helpx.adobe.com/security/products/connect/apsb21-91.html
More from Connect
10.0
CVE-2017-11291
An issue was discovered in Adobe Connect 9.6.2 and earlier versions
9.9
CVE-2026-75682
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
9.8
CVE-2023-4662
Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion
9.8
CVE-2023-4661
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection
9.8
CVE-2018-12805
Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability