CVE-2026-48361 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Connect. The flaw allows attackers to inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser upon visiting the affected page. The vulnerability impacts Adobe Connect versions up to 12.11 and 4.4. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in Adobe Connect and consider applying any available workarounds or security controls recommended by Adobe once published.