CVE-2026-34659 Adobe Connect | Deserialization of Untrusted Data (CWE-502)
Attackers can execute arbitrary code via deserialization if a victim visits a malicious URL or compromised page in Adobe Connect.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34659?
CVE-2026-34659 is a critical unsafe deserialization vulnerability in Adobe Connect, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Weakness: CWE-502
Which versions are affected by CVE-2026-34659?
It affects 1 product.
Products include Adobe Connect Desktop Application.
How do I fix CVE-2026-34659?
No fix has been published for CVE-2026-34659 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-34659 being exploited?
There is no known exploitation of CVE-2026-34659 in the wild and no public exploit code.
Other vulnerabilities in Adobe Connect
Sources
Also known as GHSA-6cgj-r9r8-5xrr.