EUVD-2026-22671
GHSA-577g-xxrf-8j42
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network access to Adobe Connect server endpoints that process serialized data - typically web-based APIs or session management interfaces listening on HTTP/HTTPS ports. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is high despite no confirmed active exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted network request containing malicious serialized objects to an internet-facing Adobe Connect server. The Connect application deserializes this untrusted data without validation, instantiating attacker-controlled classes that execute arbitrary code in the context of the Connect service account. … |
| Remediation | Upgrade Adobe Connect to version 2025.4 or later, as version 2025.3 is explicitly listed as vulnerable in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Adobe Connect deployments running version 12.10 or earlier and isolate affected instances from production networks if patch application cannot be completed immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today