CVE-2026-83964
📛 CVE Title
Adobe Connect | Improper Certificate Validation (CWE-295)
Description
Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- adobe
- CVSS severity
- MEDIUM
- CVSS score
- 6.2 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Effective score
- 6.2 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-295 - Reserved
- 2026-09-01
- Published
- 2026-09-22 18:54 UTC
- Last updated
- 2026-09-22 18:54 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83964.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-22 19:16:54 UTC
- NVD last modified
- 2026-09-22 19:23:57 UTC
- NVD CVSS v3.1
- 6.2 / 10 MEDIUM source: psirt@adobe.com
- NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Exploitability subscore
- 2.5 / 10
- Impact subscore
- 3.6 / 10
NVD / KEV / EPSS data refreshed 2026-09-23 02:37 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-84786 - Assigner
- adobe
- Published
- Sep 22, 2026, 6:54:03 PM
- Updated
- Sep 22, 2026, 6:54:03 PM
- EUVD base score (CVSS 3.1)
-
6.2 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EUVD-reported EPSS
- 0.0000
- Vendors
- Adobe
- Products
-
Adobe Connect Android Mobile App (0 ≤4.4)Adobe Connect (0 ≤12.11)
- Aliases
-
GHSA-68hg-jw2h-m6hh
ENISA description: Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
EUVD references (1)
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Adobe | Adobe Connect |
0 (affected),
12.11.1, 12.12 (unaffected)
|
— |
| Adobe | Adobe Connect Android Mobile App |
0 (affected),
4.5 (unaffected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:cybersecurefox.com
In August 2026 , F5 Labs observed a large-scale automated scanning campaign targeting internet-exposed Vite development servers. The attackers are exploiting the CVE - 2026 -39364 vulnerability — an access control bypass for file restrictions that allows unauthenticated extraction of sensitive data: environment variables, AWS and Azure credentials, and infrastructure state files (Terraform ...
2026-09-23 15:43 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-23 15:43 UTC -
web:securityonline.info
The Vite development server vulnerability CVE - 2026 -39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 events. Patch now.
2026-09-23 15:43 UTC -
web:support.servicenow.com
Due to additional analysis provided by the security researcher who discovered CVE - 2026 -6876, we have upgraded the severity rating of CVE - 2026 -6876 from High to Critical. This change affects only the severity
2026-09-23 15:43 UTC -
web:tech-insider.org
The Patch : N-central 2026.3 Hotfix 4 Explained N-able's fix arrived as Hotfix 4 for the N-central 2026.3 release line, released September 6, 2026 and noted by the Cloud Security Alliance as bringing on-premises installations to build 2026.3.1.14.
2026-09-23 15:43 UTC -
web:www.hazetec.com
CISA warns of active exploitation of three Linux kernel vulnerabilities, including one critical flaw ( CVE -2025-39964) existing for 14 years. These issues enable privilege escalation and system crashes. Federal agencies must apply updates immediately and perform forensic triage on affected assets. Public exploits exist for CVE -2025-39682 and CVE - 2026 -53266, though ransomware involvement is not ...
2026-09-23 15:43 UTC -
web:www.hexnode.com
The primary remediation for CVE - 2026 -39364 remains upgrading Vite and restricting unnecessary development-server exposure. Hexnode can complement these measures with endpoint administration, investigation and containment workflows.
2026-09-23 15:43 UTC -
web:www.secpod.com
Patch Analysis & Exploitation Timeline: Three CVEs , One Deadline, CISA's September 16, 2026 KEV Additions for Google Pixel, Cisco ISE, and Acronis Backup An analysis of three vulnerabilities added to CISA's Known Exploited Vulnerabilities Catalog on September 16, 2026 , covering Google Pixel, Cisco Identity Services Engine, and Acronis Backup, including their technical impact, vulnerability ...
2026-09-23 15:43 UTC -
web:www.techtimes.com
CISA Linux kernel vulnerability catalog update adds three actively exploited flaws on Friday, triggering a 72-hour federal patch mandate under Binding Operational Directive BOD 26-04 -- the ...
2026-09-23 15:43 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-09-23 15:43 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-83964.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Adobe Connect",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "12.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "12.11.1, 12.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Adobe Connect Android Mobile App",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-09-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 6.2,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 6.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation (CWE-295)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:54:03.446Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/connect/apsb26-150.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Adobe Connect | Improper Certificate Validation (CWE-295)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2026-83964",
"datePublished": "2026-09-22T18:54:03.446Z",
"dateReserved": "2026-09-01T00:25:45.964Z",
"dateUpdated": "2026-09-22T18:54:03.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}