CVE-2026-27303 is a critical vulnerability in Adobe Connect affecting versions 2025.3, 12.10, and earlier. It involves deserialization of untrusted data, which can be exploited remotely without user interaction to execute arbitrary code in the context of the current user. The vulnerability changes the security scope and impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No official patch or remediation level has been published yet, and no known exploits are reported in the wild. Adobe Connect is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation allows remote attackers to execute arbitrary code without user interaction, potentially leading to full compromise of the affected system under the current user context. The vulnerability affects confidentiality, integrity, and availability severely. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently published, organizations should monitor Adobe advisories closely and prepare to apply patches once available. Until then, consider restricting network access to Adobe Connect services and applying defense-in-depth controls relevant to deserialization vulnerabilities.