CVE-2026-27303

CVE-2026-27303 is a deserialization vulnerability affecting Adobe Connect versions 2025.3, 12.10, and earlier that permits arbitrary code execution within the current user's context without requiring user interaction. The flaw stems from improper handling of untrusted data during the deserialization process, creating a critical security gap in this widely-used conferencing platform. The vulnerability carries a CVSS score of 9.6 (Critical) with a network-based attack vector requiring no authentication or special privileges, though exploitation does require user interaction despite initial assessments suggesting otherwise. The attack has high impact potential across confidentiality, integrity, and availability, with scope changes indicating the ability to affect systems beyond the vulnerable component itself. Exploitation status remains limited at present, with the vulnerability absent from active exploitation databases and showing no evidence of available exploit code or widespread weaponization. The EPSS score of 0.037 indicates relatively lower probability of exploitation compared to other published vulnerabilities, and the threat has not yet been added to known exploited vulnerability catalogs, suggesting active monitoring is appropriate but immediate emergency response may not be warranted for all organizations.