Adobe Connect versions 2025.3, 12.10 and earlier contain a flaw that allows deserialization of untrusted data, which can lead to arbitrary code execution in the current user's session. This weakness is classified as CWE-502 and is noteworthy because exploitation requires the victim to visit a maliciously crafted URL or interact with a compromised web page. The vulnerability also changes the scope, meaning that the impact may extend beyond the initiating user to higher privilege levels or broader system components.

The affected product is Adobe Connect, specifically installations running version 2025.3, 12.10 or earlier. Administrators should inventory their deployments to determine if they are on a vulnerable version and plan remediation accordingly.

The flaw carries a CVSS score of 9.6, marking it critical. EPSS score is 4%, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack path involves an attacker directing a victim to a maliciously crafted URL or compromised web page, which then initiates the deserialization process; since user interaction is required, exploitation is not purely remote and depends on the victim engaging with the crafted content. Given the high severity and the 4% EPSS score, the overall risk remains significant, especially in environments where users may inadvertently visit compromised sites.