CVE-2026-34615 is a critical deserialization flaw in Adobe Connect 2025.3, 12.10 and earlier. NVD scores it 9.3. Adobe says it could lead to code execution in the context of the current user and needs a victim to visit a crafted link. Apply the update in Adobe bulletin APSB26-37.
What's affected
Adobe Connect versions 2025.3 and 12.10 and earlier, along with the Connect desktop application on Windows and macOS, per the NVD product list.
The record does not list the fixed build number. Read Adobe security bulletin APSB26-37 for the exact patched versions before you plan the update.
How to check if you're exposed
Check your Connect version in the product or the admin console, or ask your Connect administrator. Compare it with the fixed versions in bulletin APSB26-37.
If your meetings run on Adobe hosted Connect, check Adobe's notices for anything needed on your side, since the bulletin is the authority for that.
What to do now
- Read APSB26-37 and note the fixed versions for your deployment type.
- Update Connect and the desktop application on managed machines.
- Remind staff to be careful with links to Connect pages from unknown senders until the update lands.
- Add the product to your inventory so the next bulletin is easier to match.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. Software takes a serialized object from outside and rebuilds it, and a crafted input makes the rebuild do something the author never intended.
Adobe's text says exploitation needs a user to visit a crafted URL or interact with a compromised page, and the vector marks Scope Changed. Treat it as a link based risk for anyone who uses Connect.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the bulletin text I have does not claim exploitation.
Quick check
Does the desktop app need updating too?
The NVD product list includes the Connect desktop application, so yes, check it against the bulletin.
Sources
Last reviewed: 19 October 2026.
