Adobe Connect Desktop App client-side code injection via crafted URL

#Requires -Version 5.1
<# Check-CVE-2026-48360.ps1
   Checks whether the Adobe Connect Desktop App is installed and vulnerable to CVE-2026-48360.
   Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN (app not found)
#>

$ErrorActionPreference = 'SilentlyContinue'
$found = $false
$vulnerable = $false
$fixedVersion = [version]'2026.9.61'

# Check Uninstall registry keys (both 64-bit and 32-bit)
$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($path in $regPaths) {
    $entries = Get-ItemProperty $path 2>$null | Where-Object {
        $_.DisplayName -like '*Adobe Connect*' -and $_.DisplayName -notlike '*Server*'
    }
    foreach ($entry in $entries) {
        $found = $true
        $rawVer = $entry.DisplayVersion
        Write-Host "[INFO] Found: $($entry.DisplayName) version $rawVer"
        try {
            $installedVer = [version]($rawVer -replace '[^0-9.]','')
            if ($installedVer -lt $fixedVersion) {
                $vulnerable = $true
                Write-Host "[!!] Version $installedVer is BELOW fixed version $fixedVersion"
            } else {
                Write-Host "[OK] Version $installedVer is AT or ABOVE fixed version $fixedVersion"
            }
        } catch {
            Write-Host "[WARN] Could not parse version string: $rawVer"
            $vulnerable = $true  # assume vulnerable if we cannot confirm
        }
    }
}

# Also check common install paths for the executable
$exePaths = @(
    "$env:ProgramFiles\Adobe\Adobe Connect\AdobeConnectApp.exe",
    "${env:ProgramFiles(x86)}\Adobe\Adobe Connect\AdobeConnectApp.exe",
    "$env:LOCALAPPDATA\Adobe\Adobe Connect\AdobeConnectApp.exe"
)

foreach ($exe in $exePaths) {
    if (Test-Path $exe) {
        $found = $true
        $fileVer = (Get-Item $exe).VersionInfo.ProductVersion
        Write-Host "[INFO] Found executable: $exe (ProductVersion: $fileVer)"
        try {
            $fv = [version]($fileVer -replace '[^0-9.]','')
            if ($fv -lt $fixedVersion) {
                $vulnerable = $true
                Write-Host "[!!] File version $fv is BELOW fixed version $fixedVersion"
            } else {
                Write-Host "[OK] File version $fv is AT or ABOVE fixed version $fixedVersion"
            }
        } catch {
            Write-Host "[WARN] Could not parse file version: $fileVer"
        }
    }
}

# Check for URI handler registration
$uriHandler = Get-ItemProperty 'HKCR:\connectpro\shell\open\command' 2>$null
if ($uriHandler) {
    Write-Host "[INFO] connectpro:// URI handler registered: $($uriHandler.'(default)')"
}

if (-not $found) {
    Write-Host 'UNKNOWN - Adobe Connect Desktop App not detected on this host.'
    exit 2
} elseif ($vulnerable) {
    Write-Host 'VULNERABLE - Adobe Connect Desktop App is below the fixed version for CVE-2026-48360.'
    exit 1
} else {
    Write-Host 'PATCHED - Adobe Connect Desktop App is at or above the fixed version.'
    exit 0
}