A critical path traversal flaw in Adobe Connect (CVSS 9.6) could let a low-privileged attacker on the network execute arbitrary code without any user interaction.
What Is It
CVE-2026-121349 is an Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability (CWE-22) in Adobe Connect. Adobe's PSIRT says successful exploitation could lead to arbitrary code execution in the context of the current user. A low-privileged attacker could use it to gain elevated access to, or control over, a victim's account or session.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality and high integrity impact, with no availability impact
Why It Matters
The base score is 9.6 (CRITICAL). The attacker needs only a low-privileged account, the attack complexity is low, and no victim interaction is required. Because the scope is changed, a successful exploit could reach beyond the vulnerable component itself. That could make account and session takeover possible from a foothold with minimal privileges.
At the time of writing, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. NVD lists the record as "Received", which means NVD has not yet completed its analysis. It was published on 2026-11-10.
What's Vulnerable
Adobe's affected-version data covers several Adobe Connect release lines. Each line is vulnerable up to and including the listed version and fixed in the build shown:
| Affected (≤) | Fixed version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
The NVD record does not yet list any CPE entries.
Patch Status
Adobe has published security bulletin APSB26-191 for Adobe Connect. According to the vendor's version data, these builds are not affected:
- 12.8.a
- 12.9.a
- 12.10.f
- 12.11.i
- 12.12.a
Organizations running Adobe Connect should check the bulletin and update to the fixed build for their release line. Because the CVE is not in the KEV catalog, no CISA-mandated remediation deadline currently applies.