---
id: "CVE-2026-48360"
kind: "vulnerability"
aliases: ["CVE-2026-48360"]
title: "Adobe Connect: code injection lets a crafted link run code as the user"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Connect Desktop (Windows)", "fixed": ["2026.9.61"], "affected": "<= 2026.8.51", "ecosystem": "vendor"}, {"name": "Adobe Connect Desktop (Mac Silicon)", "fixed": ["2026.10.66"], "affected": "<= 2026.08.45", "ecosystem": "vendor"}, {"name": "Adobe Connect Desktop (Mac Intel)", "fixed": ["2026.10.170"], "affected": "<= 2026.01.39", "ecosystem": "vendor"}, {"name": "Adobe Connect Mobile (Android)", "fixed": ["4.5"], "affected": "<= 4.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-connect", "android", "desktop-app", "macos", "self-hosted", "user-interaction", "vendor", "windows"]
not_affected_if: ["web-only-client"]
published_at: "2026-10-27T17:17:00+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:35:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48360", "first_seen_at": "2026-10-27T17:32:46+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:35:30+00:00"}]
---

# Adobe Connect: code injection lets a crafted link run code as the user

Code injection (CWE-94, CVSS 9.6) in the Adobe Connect Desktop app: a victim who opens a crafted URL or interacts with a compromised web page can have code run as their user. Adobe says no known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect Desktop (Windows) affected <= 2026.8.51 fixed 2026.9.61
- vendor:Adobe Connect Desktop (Mac Silicon) affected <= 2026.08.45 fixed 2026.10.66
- vendor:Adobe Connect Desktop (Mac Intel) affected <= 2026.01.39 fixed 2026.10.170
- vendor:Adobe Connect Mobile (Android) affected <= 4.4 fixed 4.5

## How to check

Open the Adobe Connect desktop app's About/version and compare: Windows must be 2026.9.61 or later, Mac Silicon 2026.10.66 or later, Mac Intel 2026.10.170 or later. Android Mobile app 4.4 and earlier is also listed as affected.

## Fix

Update Adobe Connect Desktop to Windows 2026.9.61, Mac Silicon 2026.10.66, Mac Intel 2026.10.170 (Download Center). Android: 4.5 per CVE record (bulletin silent).

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48360
- 2026-10-27T17:35:30+00:00 analyst — Adobe APSB26-182 (2026-10-27, priority 2) read directly: affects Adobe Connect Desktop client, not the server/meeting platform (that was APSB26-150). Not exploited per Adobe; no PoC found. Cloud not mentioned in bulletin. Bulletin lists Android Mobile 4.4 and earlier as affected but gives no fixed row; CVE record says 4.5 unaffected.

## Documents

- [advisory] Adobe APSB26-182: Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-182.html
- [describes] CVE Record: CVE-2026-48360 https://www.cve.org/CVERecord?id=CVE-2026-48360

## From the sources

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_