Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are vulnerable to a deserialization of untrusted data flaw (CWE‑502). The weakness is exploitable to run arbitrary code under the context of the user whose browser visits a crafted URL or a compromised web page. The vulnerability changes the scope of the attack, allowing the attacker to gain control over the entire client application. Consequently, the impact is a high‑severity compromise of confidentiality, integrity, and availability for any affected user.

Adobe Connect by Adobe, specifically versions 2025.9.15, 2025.8.157 and earlier. There is no mention of other versions or editions.

The CVSS score of 9.6 indicates critical severity. EPSS data is not available, so the exploitation probability cannot be quantified, but the vulnerability is listed as not part of the KEV catalogue. The attack requires user interaction – a victim must visit a maliciously crafted URL or interact with a compromised web page – and then the deserialization flaw is triggered. Given the catastrophic consequence of arbitrary code execution, the overall risk to organizations using these versions is extremely high.