EUVD-2026-22671
GHSA-577g-xxrf-8j42
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.
Technical ContextAI
This is a CWE-502 deserialization vulnerability affecting Adobe Connect virtual meeting platform through version 12.10. Deserialization flaws occur when applications reconstruct objects from serialized data streams without proper validation, allowing attackers to instantiate arbitrary classes and execute methods. Adobe Connect processes serialized data over network protocols, likely as part of session management or API communication. The CPE identifier (cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:*) confirms all editions of Adobe Connect are affected up to and including version 12.10. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the security authority of the vulnerable component, suggesting potential lateral movement or privilege escalation beyond the Connect application itself.
RemediationAI
Upgrade Adobe Connect to version 2025.4 or later, as version 2025.3 is explicitly listed as vulnerable in the advisory. Consult Adobe security bulletin APSB26-37 at https://helpx.adobe.com/security/products/connect/apsb26-37.html for exact patched versions and installation instructions. If immediate patching is not feasible, implement network segmentation to restrict Adobe Connect access to authenticated users via VPN or internal network only, eliminating the unauthenticated network attack vector (this reduces CVSS to ~7.x by requiring network position but does not eliminate the vulnerability). Deploy web application firewall rules to inspect and block serialized Java objects in HTTP requests to Adobe Connect endpoints, though this may cause legitimate functionality failures if Connect uses serialization for normal operations. Monitor Adobe Connect application logs for deserialization exceptions or unexpected object instantiation attempts as detection measure.
More in Adobe Connect
View allArbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privi
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to ex
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today