What is the CVSS score of CVE-2026-34660?

CVE-2026-34660 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Adobe Connect are affected by CVE-2026-34660?

Adobe Connect (versions 2025.8.157 and earlier) contains a critical client-side vulnerability enabling arbitrary script execution within user browser sessions, with no public exploit identified at…

How to fix or mitigate CVE-2026-34660?

Within 24 hours, conduct a complete inventory of Adobe Connect deployments (versions 2025.8.157 and earlier) and identify high-value meetings or sensitive organizational data stored within. Within 7 days, implement browser-level security controls including Content Security Policy headers, restrict Adobe Connect access to essential personnel only, and enforce multi-factor authentication on all Connect accounts. Within 30 days, monitor Adobe Security Advisories weekly for patch availability and establish an expedited patching plan; maintain enhanced logging and monitoring of user authentication, session creation, and resource access patterns to detect compromise attempts.

Adobe Connect CVE-2026-34660

EUVD-2026-29741 CRITICAL

Incorrect Authorization (CWE-863)

2026-05-12 adobe

GHSA-2r54-572f-5p47

Authentication Bypass RCE Adobe Adobe Connect

9.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Unauthenticated network XSS-class flaw needing a victim click (UI:R); scope change to the user session (S:C) with high session confidentiality but limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:05 vuln.today

CVE Published

May 12, 2026 - 18:35 nvd

CRITICAL 9.3

DescriptionCVE.org

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.

Technical ContextAI

Adobe Connect is Adobe's web-based conferencing, virtual classroom, and webinar platform delivered through a browser front end. The root cause is CWE-863 (Incorrect Authorization): an authorization check that is present but implemented incorrectly, allowing an action or resource access that should have been denied. In practice the description's 'arbitrary code execution in the context of the current user' combined with 'inject malicious scripts into a web page' indicates browser-context script execution (an XSS-class outcome) rather than server-side native code execution. The single CPE, cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:*, scopes the flaw to the Adobe Connect application across affected release trains. The changed scope (S:C) reflects that script executing under the authorization failure can affect a security authority or resources distinct from the initially vulnerable component, e.g. the victim's authenticated Connect session.

RemediationAI

Apply the fixed release identified in Adobe Security Bulletin APSB26-50 (https://helpx.adobe.com/security/products/connect/apsb26-50.html); patch available per vendor advisory, though an exact fixed version number is not stated in the provided data and should be taken directly from APSB26-50 rather than assumed. Because exploitation depends on a victim following a crafted URL or interacting with a compromised page, compensating controls until patching include user-awareness guidance to avoid untrusted Connect links, restricting Connect access to authenticated/known users and trusted networks, and deploying a Content Security Policy and standard XSS filtering at any reverse proxy or WAF fronting Connect to blunt script injection - noting that a strict CSP can break legitimate Connect embeds or add-ins and should be tested against meeting and recording functionality first. Email/URL filtering that flags externally-sourced Connect links reduces the social-engineering delivery path but may generate false positives on legitimate meeting invitations.