High priorityDisclosed

Advisory · CVE-2026-48360

Code injection in Adobe Connect apps can execute arbitrary code from a crafted link

Adobe Connect Desktop App and Android Mobile App contain a code injection flaw that an unauthenticated attacker can use to execute arbitrary code in the context of the current user when a victim visits a maliciously crafted URL or interacts with a compromised page, with scope changed. CVSS 3.1 9.6.

Advisory published October 27, 2026Independent summary
Vendor
Adobe
Product
Adobe Connect
Identifier / CWE
CVE-2026-48360
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

A meeting app that treats a link as instructions instead of data will run whatever the link's author wrote. One click on a crafted link can turn into code running as the victim.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted link delivered

    The attacker sends the victim a maliciously crafted URL or places it on a compromised page.

  2. 02Victim interacts

    The victim visits the URL or interacts with the page, as Adobe's record requires.

  3. 03Injected code runs

    The Connect application executes the attacker-controlled code in the context of the current user.

  4. 04Scope expands

    Because scope is changed, the impact extends beyond the vulnerable component's own authority.

What happened

Adobe published CVE-2026-48360 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.6: Adobe Connect is affected by a code injection vulnerability (CWE-94) that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, in that a victim must visit a maliciously crafted URL or interact with a compromised web page, and the scope is changed.

Adobe’s bulletin APSB26-182 covers the Connect Desktop App up to 2026.8.51 on Windows, 2026.08.45 on Mac Silicon, and 2026.01.39 on Mac Intel, with 2026.9.61, 2026.10.66, and 2026.10.170 listed as the respective fixed versions, and the Android Mobile App up to 4.4, with 4.5 listed as fixed.

What to do

  1. Inventory Adobe Connect desktop and mobile app installations across managed endpoints and note each version and platform.
  2. Update desktop apps to 2026.9.61 (Windows), 2026.10.66 (Mac Silicon), or 2026.10.170 (Mac Intel), and Android apps to 4.5, or later.
  3. Until endpoints are updated, remind users not to open Connect links from unexpected messages, and consider restricting link handling to the managed browser.
  4. Review endpoint telemetry for Connect processes spawning unexpected child processes or writing files after a link was opened.
  5. Verify the deployed version after updating, including personally owned devices used for meetings.

Management note

Conferencing clients are link-driven by design, so their update cadence has to match browsers, not business applications. Push this through the standard endpoint ring and treat any Connect process doing something unusual after a meeting join as an incident lead.