Adobe Connect versions up to 2025.3 and 12.10 contain a deserialization flaw that allows a crafted payload to be executed in the context of the current user, enabling remote code execution without requiring user interaction. The vulnerability falls under CWE‑502, a known weakness for processing untrusted serialized data. An attacker who succeeds can run arbitrary code with the privileges of the current user, potentially compromising configuration, data, and any connected clients.

Adobe Connect from Adobe; versions 2025.3, 12.10 and all earlier releases are affected. Any installation of these versions—whether on a server or a client—is vulnerable.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of 0.0144 indicates a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation does not require user interaction, implying that a remote attacker can trigger the flaw through a crafted request to the Connect server, with scope expanded to affect the entire system.