EUVD-2026-22667
GHSA-p85r-hffw-65q4
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Adobe Connect instances and their versions in your environment; consult Adobe security advisory APSB26-37 for patch availability and compatibility. Within 7 days: Apply vendor patch APSB26-37 to all affected Adobe Connect deployments (version 12.10 and earlier, including 2025.3); verify patch installation across all systems. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today