CVE-2026-27303

The vulnerability consists of unsafe deserialization of untrusted data (CWE-502) — an attacker can craft a malicious serialized object and deliver it to the victim through a specially constructed URL or compromised website. When the victim visits such a link or interacts with the injected page, the Adobe Connect application deserializes the malicious payload. As a result, arbitrary code is executed in the context of the currently logged-in user.

An attacker can execute arbitrary code (RCE) in the context of the victim, potentially leading to system compromise, data theft, or further lateral movement in the network. Changed Scope indicates that the impact may extend beyond the Adobe Connect application itself.

Adobe Connect should be immediately updated to a version newer than 2025.3/12.10, applying patches available from the vendor in accordance with the official Adobe security bulletin (APSB26-37): https://helpx.adobe.com/security/products/connect/apsb26-37.html. Until the update is applied, it is recommended to exercise special caution when clicking links leading to Adobe Connect instances and to avoid visiting untrusted websites.

Adobe Connect version 2025.3, 12.10 and earlier, running on Microsoft Windows and Apple macOS (including Adobe Connect Desktop Application).