CVE-2026-34660 is an Incorrect Authorization vulnerability in Adobe Connect that affects versions 2025.9.15, 2025.8.157, and earlier. This vulnerability allows an attacker to inject malicious scripts into web pages, resulting in arbitrary code execution within the context of the current user. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a compromised page. The vulnerability changes the security scope and can lead to elevated privileges or session compromise. The CVSS 3.1 base score is 9.3, indicating critical severity. No patch or official remediation level has been published by Adobe as of the provided data.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially allowing attackers to gain elevated access or control over the victim's Adobe Connect account or session. This could compromise confidentiality and integrity of user data within the affected application. However, exploitation requires user interaction, limiting the attack vector to targeted scenarios. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted URLs or web pages related to Adobe Connect. Monitor Adobe's security advisories for updates on patches or official mitigations.