Live › vulnerability › CVE-2026-48360
Go to dashboardCode injection (CWE-94, CVSS 9.6) in the Adobe Connect Desktop app: a victim who opens a crafted URL or interacts with a compromised web page can have code run as their user. Adobe says no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Connect Desktop (Windows) | vendor | <= 2026.8.51 | 2026.9.61 |
| Adobe Connect Desktop (Mac Silicon) | vendor | <= 2026.08.45 | 2026.10.66 |
| Adobe Connect Desktop (Mac Intel) | vendor | <= 2026.01.39 | 2026.10.170 |
| Adobe Connect Mobile (Android) | vendor | <= 4.4 | 4.5 |
2026.9.61 or later, Mac Silicon 2026.10.66 or later, Mac Intel 2026.10.170 or later2026.9.61, Mac Silicon 2026.10.66, Mac Intel 2026.10.170 (Download Center)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-48360")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.