Adobe Connect versions up to 2025.3 and 12.10 contain a deserialization flaw that allows a crafted payload to be executed in the context of the current user, enabling remote code execution. The vulnerability falls under CWE‑502, a known weakness for processing untrusted serialized data. Exploitation of this issue requires user interaction: a victim must visit a maliciously crafted URL or interact with a compromised web page. An attacker who succeeds can run arbitrary code with the privileges of the current user, potentially compromising configuration, data, and any connected clients.

Adobe Connect from Adobe; versions 2025.3, 12.10 and all earlier releases are affected. Any installation of these versions—whether on a server or a client—is vulnerable.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of 4% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires user interaction, so a remote attacker must lure a user to a malicious link or page to trigger the flaw, with scope changed to affect the entire system.