Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are vulnerable to a deserialization of untrusted data flaw (CWE‑502). The weakness is exploitable to run arbitrary code under the context of the user whose browser visits a crafted URL or a compromised web page. The vulnerability changes the scope of the attack, allowing the attacker to gain control over the entire client application. Consequently, the impact is a high‑severity compromise of confidentiality, integrity, and availability for any affected user.

Adobe Connect by Adobe, specifically versions 2025.9.15, 2025.8.157 and earlier. There is no mention of other versions or editions.

The CVSS score of 9.6 indicates critical severity. The EPSS score of 3% indicates a low but nonzero probability of exploitation, though the vulnerability is not part of the KEV catalogue. The attack requires user interaction – a victim must visit a maliciously crafted URL or interact with a compromised web page – and then the deserialization flaw is triggered. Given the catastrophic consequence of arbitrary code execution, the overall risk to organizations using these versions is extremely high.