Adobe Connect
Monthly
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserialization of untrusted data (CWE-502) and runs in the context of the current user. Exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page, so it is user-interaction gated rather than fully automatic. There is no public exploit identified at time of analysis and it is not on the CISA KEV list; EPSS is modest at 1.50% (81st percentile), consistent with SSVC scoring exploitation as 'none' despite a 'total' technical impact.
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privilege escalation when low-privileged authenticated users trick victims into visiting malicious URLs. The changed scope (CVSS S:C) indicates the vulnerability can affect resources beyond the vulnerable application's security context. EPSS data not available; no evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis. Requires user interaction (UI:R) but has low attack complexity (AC:L) and network-based attack vector (AV:N), making social engineering campaigns feasible.
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserialization of untrusted data (CWE-502) and runs in the context of the current user. Exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page, so it is user-interaction gated rather than fully automatic. There is no public exploit identified at time of analysis and it is not on the CISA KEV list; EPSS is modest at 1.50% (81st percentile), consistent with SSVC scoring exploitation as 'none' despite a 'total' technical impact.
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privilege escalation when low-privileged authenticated users trick victims into visiting malicious URLs. The changed scope (CVSS S:C) indicates the vulnerability can affect resources beyond the vulnerable application's security context. EPSS data not available; no evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis. Requires user interaction (UI:R) but has low attack complexity (AC:L) and network-based attack vector (AV:N), making social engineering campaigns feasible.
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability has changed scope (CVSS 9.3), enabling impact beyond the vulnerable component. Adobe issued patch APSB26-37. EPSS indicates 81st percentile risk with 1.44% probability, and CISA SSVC reports no active exploitation. The CVSS vector conflicts with the description: vector indicates user interaction required (UI:R) while description states 'does not require user interaction' - verify actual interaction requirements with Adobe advisory.