CVE-2026-34660: fallo crítico en Adobe Connect
Adobe Connect | Incorrect Authorization (CWE-863)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.4%
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVEs relacionadas — Adobe Connect
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-27203CRITICALAdobe Connect | Deserialization of Untrusted Data (CWE-502)EPSS 1.2%CVE-2026-34689HIGHAdobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.0%CVE-2026-75682CRITICALAdobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)EPSS 1.0%CVE-2026-75686CRITICALAdobe Connect | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2024-54037HIGHAdobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.9%CVE-2024-54032CRITICALAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.8%