Adobe Connect EUVD-2026-111102

Exploitation requires victim user interaction: a user running the vulnerable Adobe Connect Desktop App (Windows ≤2026.8.51, Mac Apple Silicon ≤2026.08.45, Mac Intel ≤2026.01.39) or Android Mobile App (≤4.4) must visit a maliciously crafted URL or interact with a compromised web page. No authentication is required of the attacker (PR:N), and attack complexity is low, but the mandatory user-interaction step (UI:R) is the principal limiting factor - the attacker cannot trigger the flaw without luring a human into opening attacker-controlled content, which constrains this to phishing/watering-hole-style delivery rather than unattended remote exploitation. Impact is bounded to the context of the current user, though CVSS marks the scope as changed (S:C).

Multiple severity signals agree this is high priority but they are not all independent confirmations of real-world exploitation. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated (PR:N) code-injection flaw whose only friction is required user interaction (UI:R), with a changed scope (S:C) and full confidentiality, integrity and availability impact. The vuln.today decision label is act_now and the issue was reported by Adobe itself (APSB26-182), which drives the urgency. However, the exploitation-intelligence signals are thinner than the CVSS implies: there is no CISA KEV listing and no EPSS probability in the provided data, so widespread or confirmed in-the-wild exploitation cannot be asserted - the act_now priority rests on vendor-reported severity and the client-side RCE pattern, not on observed attacks. The key tempering factor the raw 9.6 hides is UI:R combined with the client-side nature: this is not a drive-by-free, self-propagating server flaw - a victim must be lured into visiting a crafted URL or interacting with a compromised page, making it well-suited to targeted phishing/watering-hole delivery rather than automated mass exploitation. Net: treat as a genuine high priority for patching given act_now, critical score and vendor origin, but note that EPSS is missing and KEV is absent, so the probability of opportunistic mass exploitation is unquantified from the available data.

An attacker crafts a malicious URL or compromises a web page and uses phishing or a watering-hole lure to get an Adobe Connect user to open it. When the victim (running the vulnerable Desktop App or Android Mobile App) interacts with the content, the code-injection flaw executes attacker-supplied code in the context of the current user. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:R) and the description.