Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. The scope of the vulnerability is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.6 | CVE-2026-27303 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted data to the affected Adobe Connect application over the network. Since the attack complexity is low and does not require user interaction, an attacker can execute arbitrary code in the context of the current user, leading to potential system compromise.
Affected Products
- Adobe Connect 2025.3: Affected by a critical vulnerability allowing arbitrary code execution.
- Adobe Connect 12.10: Vulnerable to deserialization issues that can be exploited remotely.
- Earlier versions: All versions prior to 2025.3 and 12.10 are also impacted by this vulnerability.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Adobe Connect as soon as possible. Regularly applying security patches and updates can help protect against known vulnerabilities. Additionally, restricting network access to the application can reduce the risk of exploitation.