CVE-2026-27303

Published: Apr 14, 2026Modified: Jun 17, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: NVD

Description

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Affected (3)

Products: Adobe: Connect, Connect Desktop Application

2 products

Connect Desktop Application

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Adobe Connect	Before 12.11

Running on/with	Platform Versions
Apple Macos	All versions
Microsoft Windows	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Adobe Connect Desktop Application	Up to 2025.3
Adobe Connect Desktop Application	Before 2025.9.15

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

https://helpx.adobe.com/security/products/connect/apsb26-37.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.