EUVD-2026-22667
GHSA-p85r-hffw-65q4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. Adobe released patch APSB26-37. EPSS score of 1.50% (81st percentile) indicates moderate exploitation probability. No active exploitation confirmed (SSVC: exploitation=none), but deserialization flaws are commonly targeted once details emerge.
Technical ContextAI
This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where Adobe Connect accepts and processes serialized objects from untrusted sources without proper validation. Deserialization flaws are prevalent in Java, .NET, and other frameworks that convert byte streams into executable objects. When attackers craft malicious serialized payloads containing executable code or object references, the application deserializes them directly into memory, triggering code execution. The affected product is identified via CPE cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:* covering all versions through 12.10, including the specifically mentioned 2025.3 release. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security authority, suggesting potential for container escape, privilege escalation to system level, or lateral movement within the deployment environment.
RemediationAI
Apply Adobe Security Bulletin APSB26-37 patch immediately by upgrading to the version specified in https://helpx.adobe.com/security/products/connect/apsb26-37.html (exact patched version number not provided in available data but confirmed available per vendor advisory). For internet-facing Connect servers, prioritize patching within 24-48 hours given the critical CVSS score and network attack vector. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: restrict network access to Adobe Connect servers via firewall rules allowing only trusted IP ranges (reduces attack surface but impacts legitimate remote users); deploy web application firewall with deserialization attack signatures to inspect and block malicious payloads (may cause false positives with legitimate serialized data and requires signature updates); disable or restrict file upload and external data input features if business requirements permit (significantly limits functionality but prevents untrusted data ingestion). Each workaround degrades Adobe Connect functionality or accessibility, making vendor patching the strongly preferred remediation path. Monitor Adobe's advisory for any additional configuration hardening recommendations specific to this vulnerability class.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today