CVE-2026-27303 is a critical (CVSS 9.6) deserialization of untrusted data flaw in Adobe Connect versions 2025.3, 12.10 and earlier. It can lead to code execution in the context of the current user, and needs a victim to visit a crafted URL. Apply the update in Adobe bulletin APSB26-37.
What's affected
Adobe Connect versions 2025.3, 12.10 and earlier, per the record. The record also lists the Connect desktop application and the macOS and Windows platforms.
The record does not state fixed version numbers. Adobe's bulletin APSB26-37 is the place to confirm them, so open it and note the exact updated builds before you plan the change.
How to check if you're exposed
Check your Connect version in the administration console or with your hosting provider. If you are on 2025.3 or 12.10 or earlier, you are in the affected range named by the record.
If Adobe hosts your Connect service, ask your account contact whether the update is already applied. Self hosted installations need the patch applied by your team.
What to do now
- Open Adobe bulletin APSB26-37 and find the fixed versions for your deployment.
- Update Adobe Connect, and the desktop application if you use it, to the fixed builds.
- Tell users to avoid following unexpected links to your Connect address until the update is applied.
- Review web proxy logs for odd URLs pointing at your Connect host.
- Add Connect to your tracked inventory so future bulletins reach the right owner.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. When software rebuilds objects from data it did not create, a crafted input can make it run unintended behavior. The record says this can result in arbitrary code execution as the current user, with changed scope.
This one is more serious than the XSS items in the same bulletin because it reaches code execution. The record does not mark this CVE as known exploited.
Quick check
How is this different from the XSS flaws in the same bulletin?
It is deserialization of untrusted data, and the record says it can lead to arbitrary code execution in the context of the current user.
Sources
- CVE-2026-27303 on Gold
- NVD record for CVE-2026-27303, published 14 April 2026
- Adobe security bulletin APSB26-37 listed in the record (the page refused an automated fetch, so check it directly): https://helpx.adobe.com/security/products/connect/apsb26-37.html
Last reviewed: 19 October 2026.
