CVE-2026-48360 is a critical (CVSS 9.6) code injection vulnerability in the Adobe Connect desktop and Android apps. It could let an attacker run arbitrary code once a victim visits a malicious URL or a compromised web page.
What Is It
Adobe's description says Adobe Connect has an Improper Control of Generation of Code ("Code Injection") vulnerability, classified as CWE-94. A successful exploit could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction. The victim must visit a maliciously crafted URL or interact with a compromised web page. Adobe notes that the scope is changed, which means a successful attack can affect resources beyond the vulnerable component.
Adobe PSIRT published the CVE on 2026-10-27. NVD currently lists its status as "Received."
Why It Matters
Adobe PSIRT scored the flaw 9.6 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. In practice, that means:
- Network-reachable with low attack complexity
- No privileges required. The attacker only needs a victim to click or browse.
- High impact to confidentiality, integrity, and availability
- Changed scope, so the impact can extend past the vulnerable app
The attack needs user interaction, but the vector only asks the victim to visit a URL or web page. That may offer limited protection, because phishing links and compromised sites are common ways to deliver attacks.
As of publication, the CISA Known Exploited Vulnerabilities catalog has no entry for CVE-2026-48360. That means KEV does not currently confirm active exploitation, and none is claimed here.
What's Vulnerable
According to Adobe's affected-product data:
Adobe Connect Desktop App - Windows: 2026.8.51 and earlier - Mac Silicon: 2026.08.45 and earlier - Mac Intel: 2026.01.39 and earlier
Adobe Connect Android Mobile App - 4.4 and earlier
Patch Status
Adobe lists these versions as unaffected:
Adobe Connect Desktop App - Windows: 2026.9.61 - Mac Silicon: 2026.10.66 - Mac Intel: 2026.10.170
Adobe Connect Android Mobile App - 4.5
Organizations should update the Adobe Connect desktop and Android clients to these versions or later. Advisory APSB26-182 has the vendor's guidance. If the direct bulletin link below doesn't resolve, look up APSB26-182 on Adobe's Security Bulletins and Advisories index. CISA has not issued a KEV required action or due date, because there is no KEV listing for this CVE.
Sources
- Adobe Security Bulletin APSB26-182 (Adobe Connect) (bulletin link as referenced in the CVE record)
- Adobe Security Bulletins and Advisories (index)
- NVD: CVE-2026-48360
- CISA Known Exploited Vulnerabilities Catalog