What is the CVSS score of CVE-2026-27303?

CVE-2026-27303 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of Adobe Connect are affected by CVE-2026-27303?

Adobe Connect versions 12.10 and earlier contain a critical remote code execution vulnerability (CVE-2026-27303, CVSS 9.6) that allows unauthenticated attackers to execute arbitrary code through…

How to fix or mitigate CVE-2026-27303?

Within 24 hours: Identify all Adobe Connect instances and their versions in your environment; consult Adobe security advisory APSB26-37 for patch availability and compatibility. Within 7 days: Apply vendor patch APSB26-37 to all affected Adobe Connect deployments (version 12.10 and earlier, including 2025.3); verify patch installation across all systems. Within 30 days: Conduct post-patch validation testing; review access logs for suspicious deserialization activity; confirm no rollback to unpatched versions.

Adobe Connect CVE-2026-27303

EUVD-2026-22667 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-14 adobe

GHSA-p85r-hffw-65q4

RCE Deserialization Adobe Adobe Connect

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 03:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 19:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 18:01 euvd

EUVD-2026-22667

Analysis Generated

Apr 14, 2026 - 18:01 vuln.today

CVE Published

Apr 14, 2026 - 17:33 nvd

CRITICAL 9.6

DescriptionNVD

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization. Attack requires no user interaction despite UI:R in CVSS vector, with scope change enabling container escape or privilege escalation beyond the application context. Adobe released patch APSB26-37. EPSS score of 1.50% (81st percentile) indicates moderate exploitation probability. No active exploitation confirmed (SSVC: exploitation=none), but deserialization flaws are commonly targeted once details emerge.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where Adobe Connect accepts and processes serialized objects from untrusted sources without proper validation. Deserialization flaws are prevalent in Java, .NET, and other frameworks that convert byte streams into executable objects. When attackers craft malicious serialized payloads containing executable code or object references, the application deserializes them directly into memory, triggering code execution. The affected product is identified via CPE cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:* covering all versions through 12.10, including the specifically mentioned 2025.3 release. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security authority, suggesting potential for container escape, privilege escalation to system level, or lateral movement within the deployment environment.

RemediationAI

Apply Adobe Security Bulletin APSB26-37 patch immediately by upgrading to the version specified in https://helpx.adobe.com/security/products/connect/apsb26-37.html (exact patched version number not provided in available data but confirmed available per vendor advisory). For internet-facing Connect servers, prioritize patching within 24-48 hours given the critical CVSS score and network attack vector. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: restrict network access to Adobe Connect servers via firewall rules allowing only trusted IP ranges (reduces attack surface but impacts legitimate remote users); deploy web application firewall with deserialization attack signatures to inspect and block malicious payloads (may cause false positives with legitimate serialized data and requires signature updates); disable or restrict file upload and external data input features if business requirements permit (significantly limits functionality but prevents untrusted data ingestion). Each workaround degrades Adobe Connect functionality or accessibility, making vendor patching the strongly preferred remediation path. Monitor Adobe's advisory for any additional configuration hardening recommendations specific to this vulnerability class.