CVE-2025-27203 Adobe Connect | Deserialization of Untrusted Data (CWE-502)
An attacker can achieve arbitrary code execution in Adobe Connect via deserialization of untrusted data, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-27203?
CVE-2025-27203 is a critical unsafe deserialization vulnerability in Adobe Connect, published on 8 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does require user interaction and scope is changed.
Weakness: CWE-502
Which versions are affected by CVE-2025-27203?
It affects 1 product.
Products include Adobe Connect Desktop Application.
How do I fix CVE-2025-27203?
No fix has been published for CVE-2025-27203 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-27203 being exploited?
There is no known exploitation of CVE-2025-27203 in the wild and no public exploit code.
Other vulnerabilities in Adobe Connect
Sources
Also known as GHSA-w9pg-9w7m-8c66.