All vulnerabilities
CVE-2026-48360

Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)

Adobe Adobe Connect Desktop App
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Text from CVE List

Affected versions 4

  • Adobe Connect Desktop Appaffected: all versions through 2026.8.51 (Win), 2026.08.45 (Mac Silicon), 2026.01.39 (Mac Intel)CVE List
  • Adobe Connect Desktop Appunaffected: 2026.9.61 (Win), 2026.10.66 (Mac Silicon), 2026.10.170 (Mac Intel)CVE List
  • Adobe Connect Android Mobile Appaffected: all versions through 4.4CVE List
  • Adobe Connect Android Mobile Appunaffected: 4.5CVE List

References 1