CVE-2026-34615Disclosure(adobe / connect)

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch adobe connect systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

adobe CVEs Back to dashboard

3.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://helpx.adobe.com/security/products/connect/apsb26-37.html

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

connect
connect_desktop_application
macos
windows

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 1d ago at 3 mentions (2026-04-15); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

adobe apple microsoft

Products

connectconnect_desktop_applicationmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	2	Disclosure1Patch1
2026-04-15	3	Disclosure3
2026-05-06	1	Disclosure1

Full discourse6 posts

にゃん☆たく/takumi.a@taku888infinity177d
Patch
ぱっちちゅーずでー ◆ Microsoft 2026 年 4 月のセキュリティ更新プログラム (月例) https://www.microsoft.com/en-us/msrc/blog/2026/04/202604-security-update CVE-2026-33825 Microsoft Defender の特権の昇格の脆弱性 CVE-2026-32201 Microsoft SharePoint Server のなりすましの脆弱性 ◆Fortinet https://fortiguard.fortinet.com/psirt ・FG-IR-26-100 / CVE-2026-39808 FortiSandbox 4.4系のAPIにある OSコマンドインジェクション。細工したリクエストを受けると、認証なしで任意コードや任意コマンドを実行される恐れがあります。外部公開や到達可能性がある環境では、優先度高めでの確認が必要です。・FG-IR-26-112 / CVE-2026-39813 FortiSandbox のJRPC APIにあるパストラバーサル起因の認証回避・権限昇格。特別に細工したHTTPリクエストで未認証のまま認証をバイパスし、権限を引き上げられる可能性があるため、管理API露出環境では特に注意が必要です。・FG-IR-26-121 / CVE-2026-22828 FortiAnalyzer Cloud / FortiManager Cloud の oftpd にあるヒープベースのバッファオーバーフロー。細工したリクエストにより、リモートの未認証攻撃者が任意コードやコマンド実行に至る可能性がありますが、悪用にはASLRや分離構成を踏まえた準備が必要です。 ◆Ivanti https://www.ivanti.com/blog/april-2026-security-update https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-4913-CVE-2026-4… ◆Adobe（Criticalで任意のコード実行のみ抽出） https://helpx.adobe.com/security.html ・Adobe ColdFusion（APSB26-38） CVE-2026-27304, CVE-2026-27306 入力検証不備により、任意のコード実行につながる脆弱性・Adobe Connect（APSB26-37） CVE: CVE-2026-27302, CVE-2026-27303, CVE-2026-27243, CVE-2026-27245, CVE-2026-27246, CVE-2026-34615 デシリアライズ不備や XSS を起点に、任意のコード実行が可能となる脆弱性・Adobe FrameMaker（APSB26-36） CVE: CVE-2026-27290, CVE-2026-27292, CVE-2026-27293, CVE-2026-27294, CVE-2026-27295, CVE-2026-27296, CVE-2026-27297, CVE-2026-27298 任意のコード実行につながる脆弱性群・Adobe Bridge（APSB26-39） CVE: CVE-2026-34630, CVE-2026-27310, CVE-2026-27311, CVE-2026-27312, CVE-2026-27313 複数のヒープベース・バッファオーバーフローにより、任意のコード実行が可能になる脆弱性・Adobe Photoshop（APSB26-40） CVE: CVE-2026-27289 境界外読み取りにより、任意のコード実行につながる脆弱性・Adobe Illustrator（APSB26-42） CVE: CVE-2026-34618 境界外書き込みにより、任意のコード実行につながる脆弱性 ◆SAP SAP Security Patch Day - April 2026 https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2026.html CVE-2026-27681 https://www.cve.org/CVERecord?id=CVE-2026-27681 『（直訳）SAP Business Planning and ConsolidationおよびSAP Business Warehouseにおける認証チェックの不備により、認証済みのユーザーが細工されたSQL文を実行してデータベースデータを読み取り、変更、削除できる脆弱性が存在します。これは、システムの機密性、完全性、可用性に重大な影響を及ぼします。』
Post summary
The newsletter lists numerous CVEs across vendors with links to official security updates and technical details, emphasizing available patches but not providing exploits or proof of active compromise.
000321.4K
11.7K followersView on X
0day Signal@0dayPublishing177d
Disclosure
🚨 CVE-2026-34615: Adobe Connect | Deserialization ... Adobe Connect's deserialization bug hands remote attackers RCE on a silver platter - no user interaction needed, scope ... https://zerodaysignal.com/vulnerability/CVE-2026-34615 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-34615, a deserialization vulnerability in Adobe Connect that enables remote code execution without user interaction, and links to a resource likely containing further details.
0000271
218 followersView on X
S2GRUPO@s2grupo156d
Disclosure
💥🖥️ CVE-2026-27303, CVE-2026-34615 y CVE-2026-27246 afectan a Adobe Connect, una plataforma muy utilizada en entornos corporativos para videoconferencias, formación online y colaboración remota. Descubre más sobre esta vulnerabilidad aquí: https://hubs.la/Q04dKd2n0
Post summary
The tweet announces that three CVEs (CVE‑2026‑27303, CVE‑2026‑34615, CVE‑2026‑27246) affect Adobe Connect and provides a link for further details, but offers no additional technical or exploit information.
00010158
5.1K followersView on X
CVE@CVEnew177d
Disclosure
CVE-2026-34615 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in th… https://www.cve.org/CVERecord?id=CVE-2026-34615
Post summary
The post announces that CVE-2026-34615 is a deserialization flaw in Adobe Connect capable of arbitrary code execution, but provides no evidence of exploitation, patches, or proof of concept.
0000081
57.2K followersView on X
dbugs@ptdbugs177d
Disclosure
Adobe Connect | Deserialization of Untrusted Data (CWE-502) CVE: CVE-2026-34615 PT ID: PT-2026-32889 Vendor: Adobe Product: Adobe Connect CVSS: 9.3 Credits: n/a Description: Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-34615 • https://helpx.adobe.com/security/products/connect/apsb26-37.html #dbugs_vuln
Post summary
Adobe Connect CVE-2026-34615 is a high‑severity deserialization bug that can lead to arbitrary code execution; a vendor advisory with patch information is available.
0000058
797 followersView on X
Kaitan ID Security@KaitanSecurity177d
Disclosure
🚨 CRITICAL — CVE-2026-34615 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that… CVSS 9.3 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-34615 #Adobe #CyberSecurity #InfoSec
Post summary
The post discloses CVE-2026-34615 as a critical deserialization vulnerability affecting Adobe Connect, noting no patch yet and linking to a full analysis.
000000
144 followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	connect	-	-	-
App	adobe	connect_desktop_application	-	macos	-
App	adobe	connect_desktop_application	-	windows	-
OS	apple	macos	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard adobe CVEs apple CVEs microsoft CVEs connect vulnerabilities

What researchers are saying

CVE-2026-34615

にゃん☆たく/takumi.a[verified]@taku888infinityPatch

The newsletter lists numerous CVEs across vendors with links to official security updates and technical details, emphasizing available patches but not providing exploits or proof of active compromise.

dbugs[verified]@ptdbugsDisclosure

Adobe Connect CVE-2026-34615 is a high‑severity deserialization bug that can lead to arbitrary code execution; a vendor advisory with patch information is available.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post discloses CVE-2026-34615 as a critical deserialization vulnerability affecting Adobe Connect, noting no patch yet and linking to a full analysis.

0day Signal@0dayPublishingDisclosure

The post announces CVE-2026-34615, a deserialization vulnerability in Adobe Connect that enables remote code execution without user interaction, and links to a resource likely containing further details.

S2GRUPO@s2grupoDisclosure

The tweet announces that three CVEs (CVE‑2026‑27303, CVE‑2026‑34615, CVE‑2026‑27246) affect Adobe Connect and provides a link for further details, but offers no additional technical or exploit information.

CVE@CVEnewDisclosure

The post announces that CVE-2026-34615 is a deserialization flaw in Adobe Connect capable of arbitrary code execution, but provides no evidence of exploitation, patches, or proof of concept.