{"id":"CVE-2026-48360","kind":"vulnerability","aliases":["CVE-2026-48360"],"related":[],"title":"Adobe Connect: code injection lets a crafted link run code as the user","description":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","summary":"Code injection (CWE-94, CVSS 9.6) in the Adobe Connect Desktop app: a victim who opens a crafted URL or interacts with a compromised web page can have code run as their user. Adobe says no known exploitation.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect Desktop (Windows)","fixed":["2026.9.61"],"affected":"<= 2026.8.51","ecosystem":"vendor"},{"name":"Adobe Connect Desktop (Mac Silicon)","fixed":["2026.10.66"],"affected":"<= 2026.08.45","ecosystem":"vendor"},{"name":"Adobe Connect Desktop (Mac Intel)","fixed":["2026.10.170"],"affected":"<= 2026.01.39","ecosystem":"vendor"},{"name":"Adobe Connect Mobile (Android)","fixed":["4.5"],"affected":"<= 4.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","android","desktop-app","macos","self-hosted","user-interaction","vendor","windows"],"not_affected_if":["web-only-client"],"how_to_check":"Open the Adobe Connect desktop app's About/version and compare: Windows must be 2026.9.61 or later, Mac Silicon 2026.10.66 or later, Mac Intel 2026.10.170 or later. Android Mobile app 4.4 and earlier is also listed as affected.","fix":"Update Adobe Connect Desktop to Windows 2026.9.61, Mac Silicon 2026.10.66, Mac Intel 2026.10.170 (Download Center). Android: 4.5 per CVE record (bulletin silent).","status":"open","published_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:13+00:00","updated_at":"2026-10-27T17:35:30+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-27T17:34:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Connect: code injection lets a crafted link run code as the user","impact":"high","summary":"Adobe Connect has a code injection flaw that lets an attacker run arbitrary code in the context of the current user. Exploitation requires the victim to visit a malicious URL or interact with a compromised web page.","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Arbitrary code runs as the victim user through a crafted link","analyst_note":"Find the Adobe security bulletin for CVE-2026-48360 for affected versions, fixed builds and whether Adobe Connect Cloud is affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000507,"input_tokens":3352,"output_tokens":344,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for CVE-2026-48360 for affected versions, fixed builds and whether Adobe Connect Cloud is affected.","search":"'-2026':15A,18A '-48360':16A,19A '-94':57B '9.6':59B 'adob':1A,39B,62B,87B,92C 'adobe':20A,24A,29A,34A 'adobe-connect':38B 'affect':95C 'android':37A,41B 'app':44B,65B 'arbitrari':111C,129C 'attack':122C 'chang':157C 'code':3A,10A,54B,82B,103C,104C,112C,130C 'compromis':77B,152C 'connect':2A,21A,25A,30A,35A,40B,63B,93C 'context':116C 'control':99C 'could':108C,123C 'craft':7A,71B,146C 'current':119C 'cve':14A,17A 'cvss':58B 'cwe':56B 'desktop':22A,26A,31A,43B,64B 'desktop-app':42B 'execut':113C,128C 'exploit':91B,124C,131C 'generat':101C 'host':48B 'improp':98C 'inject':4A,55B,105C 'intel':33A 'interact':51B,74B,137C,149C 'issu':134C 'known':90B 'let':5A 'link':8A 'mac':27A,32A 'maco':45B 'malici':145C 'mobile':36A 'must':142C 'open':69B 'page':79B,154C 'requir':135C 'result':109C 'run':9A,83B 'say':88B 'scope':155C 'self':47B 'self-host':46B 'silicon':28A 'url':72B,147C 'user':13A,50B,86B,120C,136C 'user-interact':49B 'vendor':52B 'victim':67B,141C 'visit':143C 'vulner':106C,126C 'web':78B,153C 'window':53B 'windows':23A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-27T17:35:30Z","by":"analyst","run_id":891},"how_to_check":{"at":"2026-10-27T17:35:30Z","by":"analyst","run_id":891},"who_affected":{"at":"2026-10-27T17:35:30Z","by":"analyst","run_id":891}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48360","severity":null,"published_at":"2026-10-27T17:17:00+00:00","modified_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-48360:891","url":null,"severity":null,"published_at":"2026-10-27T17:35:30+00:00","modified_at":"2026-10-27T17:35:30+00:00","first_seen_at":"2026-10-27T17:35:30+00:00","fetched_at":"2026-10-27T17:35:30+00:00","note":"Adobe APSB26-182 (2026-10-27, priority 2) read directly: affects Adobe Connect Desktop client, not the server/meeting platform (that was APSB26-150). Not exploited per Adobe; no PoC found. Cloud not mentioned in bulletin. Bulletin lists Android Mobile 4.4 and earlier as affected but gives no fixed row; CVE record says 4.5 unaffected."}],"documents":[{"id":7176,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-182.html","title":"Adobe APSB26-182: Security update available for Adobe Connect","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7178,"url":"https://www.cve.org/CVERecord?id=CVE-2026-48360","title":"CVE Record: CVE-2026-48360","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}