Adobe Connect versions 2025.3, 12.10 and earlier contain a deserialization flaw that allows arbitrary code execution when untrusted data is processed. The flaw is classified as CWE‑502 and is significant because an attacker can leverage it to run code with the privileges of the current user. The description notes that the flaw changes the scope, which means that code execution can potentially affect higher-privileged components or system-level resources beyond the single user.

The affected product is Adobe Connect, version 2025.3, 12.10, and all earlier releases. Administrators should verify that they are not running these versions and plan remediation accordingly.

The CVSS score of 9.6 identifies the vulnerability as critical. The EPSS score is less than 1 percent, indicating a low but non‑zero probability of exploitation, and the flaw is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote but requires user interaction in that an attacker sends a malicious URL or composes a compromised web page that the victim visits, from which the deserialization occurs. Although the vulnerability is high‑severity, the low EPSS indicates that real‑world exploitation is currently rare, but the scope change expands potential impact across the system.