CVE-2026-48360

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.adobe.com/trust/security/products/connect/apsb26-182.html

Configurations

No configuration.

History

27 Oct 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-27 17:17

Updated : 2026-10-29 04:18

NVD link : CVE-2026-48360

Mitre link : CVE-2026-48360

CVE.ORG link : CVE-2026-48360

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-48360", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48360", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-28T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Connect Desktop App", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.8.51 (Win), 2026.08.45 (Mac Silicon), 2026.01.39 (Mac Intel)"}, {"status": "unaffected", "version": "2026.9.61 (Win), 2026.10.66 (Mac Silicon), 2026.10.170 (Mac Intel)", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Adobe Connect Android Mobile App", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4"}, {"status": "unaffected", "version": "4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-27T17:17:00.740", "references": [{"url": "https://www.adobe.com/trust/security/products/connect/apsb26-182.html", "source": "psirt@adobe.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}], "lastModified": "2026-10-29T04:18:38.040", "sourceIdentifier": "psirt@adobe.com"}