CVE-2026-34615

CVE-2026-34615 is a critical deserialization vulnerability affecting Adobe Connect versions 2025.3, 12.10 and earlier that allows unauthenticated attackers to execute arbitrary code in the context of the current user without requiring any user interaction. The vulnerability stems from improper handling of untrusted data during the deserialization process. The vulnerability carries a CVSS score of 9.3 (Critical) with a network-based attack vector, low attack complexity, and no authentication requirements. While user interaction is marked in the CVSS scoring, exploitation can achieve high confidentiality and integrity impacts, with scope changes that affect resources beyond the vulnerable component itself. There is no evidence of active exploitation at this time, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and is classified as Inactive on the Hot List. The EPSS score of 0.036 indicates relatively low probability of exploitation in the wild, though the moderate FAUCET Risk Score of 57.0 suggests organizations should prioritize patching given the severity rating and potential for impact.