Description
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Published: 2026-10-27
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Arbitrary code execution
Action: Monitor
AI Analysis

Impact

Adobe Connect is vulnerable to a code injection flaw that can lead to arbitrary code execution in the context of the current user. Exploitation requires the user to visit a malicious URL or interact with a compromised web page, and the flaw changes the scope of the application.

Affected Systems

The affected products are the Adobe Connect Android Mobile App and the Adobe Connect Desktop App. No specific version information is available in the provided data.

Risk and Exploitability

The vulnerability has a CVSS score of 9.6, indicating high severity, and no EPSS score is available. It is not listed in the CISA KEV catalog. The likely attack vector is user interaction through a maliciously crafted URL or compromised web page, allowing an attacker to inject and execute code within the application’s environment.

Generated by OpenCVE AI on October 27, 2026 at 17:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify whether your deployment of Adobe Connect (desktop or Android) is vulnerable and, if a patch is available, upgrade to the latest version from Adobe’s security site.
  • Educate users to avoid opening unknown or untrusted URLs and consider enforcing web‑filtering or antivirus scanning to block malicious content that can trigger the flaw.
  • Configure the application or network to restrict execution of externally generated code and deploy general application hardening measures such as disabling unused scripting features or using sandboxing approaches.

Generated by OpenCVE AI on October 27, 2026 at 17:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Title Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-27T16:38:56.785Z

Reserved: 2026-05-21T15:28:38.140Z

Link: CVE-2026-48360

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T17:17:00.740

Modified: 2026-10-27T17:17:00.740

Link: CVE-2026-48360

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T17:30:08Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')