What is the CVSS score of CVE-2026-34659?

CVE-2026-34659 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of Adobe Connect are affected by CVE-2026-34659?

A critical arbitrary code execution vulnerability in Adobe Connect (versions 2025.9.15 and earlier) could allow attackers to compromise user systems when victims interact with malicious URLs or…

How to fix or mitigate CVE-2026-34659?

Within 24 hours: immediately inventory all Adobe Connect deployments and versions in use, then assess the number of users and business criticality of each instance. Within 7 days: implement compensating controls including network segmentation or access restrictions for Adobe Connect, enable security monitoring for exploitation attempts, and notify users to avoid untrusted links or web sources directing to Connect sessions. Within 30 days: coordinate with Adobe for patch availability, prepare for immediate deployment of patched Adobe Connect versions, and evaluate whether to temporarily restrict Adobe Connect usage for users who cannot be adequately protected from malicious URL exposure.

Adobe Connect CVE-2026-34659

EUVD-2026-29740 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-12 adobe

GHSA-6cgj-r9r8-5xrr

RCE Deserialization Adobe Adobe Connect

9.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable deserialization with no attacker privileges but mandatory victim interaction (UI:R); code execution yields high C/I/A and Adobe states scope is changed (S:C).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:05 vuln.today

CVE Published

May 12, 2026 - 18:35 nvd

CRITICAL 9.6

DescriptionCVE.org

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserialization of untrusted data (CWE-502) and runs in the context of the current user. Exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page, so it is user-interaction gated rather than fully automatic. There is no public exploit identified at time of analysis and it is not on the CISA KEV list; EPSS is modest at 1.50% (81st percentile), consistent with SSVC scoring exploitation as 'none' despite a 'total' technical impact.

Technical ContextAI

The affected product is Adobe Connect (cpe:2.3:a:adobe:adobe_connect), Adobe's web-conferencing and virtual meeting/webinar platform used for online training and collaboration. The root cause is CWE-502, Deserialization of Untrusted Data: the application reconstructs objects from attacker-influenced serialized input without adequately validating or restricting the types being instantiated, allowing a crafted serialized payload to reach unintended code paths (gadget chains) that culminate in code execution. Because the CVSS vector marks scope as changed (S:C), the impact crosses the security boundary of the vulnerable component, affecting resources beyond the process performing the deserialization.

RemediationAI

Patch available per vendor advisory Adobe APSB26-50 (https://helpx.adobe.com/security/products/connect/apsb26-50.html) - apply the Adobe-provided fixed release for Adobe Connect (above 2025.9.15/2025.8.157) as the primary remediation; an exact fixed version string is not present in the available intelligence data, so consult APSB26-50 for the precise patched build and do not assume an unverified version number. Because exploitation is gated on a victim visiting a malicious URL or compromised page, effective compensating controls while patching include user-awareness guidance to avoid untrusted Adobe Connect links, network/proxy filtering to block or warn on suspicious external Connect URLs, and restricting Connect access to authenticated users over trusted networks or VPN where feasible (trade-off: URL filtering can generate false positives and network restriction may impede legitimate external meeting participants). If server-side deserialization is confirmed, restricting inbound access to the Connect application server to known clients further reduces exposure at the cost of blocking public or guest access.