Critical severity · published May 12, 2026
CVE-2026-34659
Adobe Connect | Deserialization of Untrusted Data (CWE-502)
9.6
CVSS
0.6%
EPSS
No
On KEV
Description
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Adobe Connect · Adobe
through 12.11 · source: vendor
AC
Adobe Connect Desktop Application · Adobe
through 2025.9.15 (Win), 2025.8.157 (Mac) · source: vendor
CD
Connect Desktop Application · Adobe
through 2025.8.157; 2025.9.15 · source: NVD
Affected product
AC
Adobe Connect
Adobe
More from Adobe Connect
9.9
CVE-2026-75682
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
9.6
CVE-2026-27303
Adobe Connect | Deserialization of Untrusted Data (CWE-502)
9.3
CVE-2026-75689
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
9.3
CVE-2026-75686
Adobe Connect | Improper Input Validation (CWE-20)
9.3
CVE-2026-75698
Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)