EUVD-2026-84786
GHSA-68hg-jw2h-m6hh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Improper certificate validation requires an active man-in-the-middle intercept position, so AC:H rather than AC:L; no auth or interaction needed, confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
AnalysisAI
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to intercept the TLS connection used by Adobe Connect (server ≤12.11 or the Android mobile app ≤4.4) - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) rates this as network-reachable, unauthenticated, low-complexity with high confidentiality impact and no integrity/availability effect - consistent with an information-disclosure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the release published in Adobe security advisory APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html); the input data does not provide an exact patched version string, so confirm the fixed build from that advisory rather than assuming, and patch both the Connect server (to a version beyond the listed 12.11 ceiling) and the Android mobile app (beyond the listed 4.4 ceiling), since fixing only one side leaves the other vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Adobe Connect server instances are at or below version 12.11 and which managed Android devices run the Connect app at or below 4.4, and flag them as unpatched in the asset inventory; issue an internal advisory directing staff to avoid using Adobe Connect on untrusted or public networks until further notice and to prefer corporate VPN or trusted corporate Wi-Fi. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today