EUVD-2026-84784
GHSA-g2gw-rc3r-xccv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated network delivery but victim must click (UI:R); 'current user context' browser-side execution with scope change warrants C:L/I:L rather than server-grade C:H/I:H, and A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires user interaction: a victim with access to Adobe Connect must visit an attacker-crafted URL or interact with a compromised web page - there is no drive-by or fully automated path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N describes an unauthenticated, network-reachable, low-complexity flaw whose only gating factor is user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix released with Adobe security bulletin APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html); the supplied data does not include an exact fixed version string, so confirm the applicable version in the bulletin's solution table before upgrading, and update the Adobe Connect Android mobile app through Google Play or Managed Google Play alongside the server/web components. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Adobe Connect web application and Adobe Connect Android mobile app are deployed, identify affected user populations, and issue an urgent user advisory to avoid unsolicited Adobe Connect links or unexpected Adobe Connect pages; because no vendor-released patch is identified at time of analysis, also consider temporarily blocking the Android app or restricting access to trusted networks if operationally feasible and enable verbose logging on Adobe Connect and endpoint security tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today