Adobe Connect has a critical path traversal flaw (CVSS 10.0). According to Adobe, it could lead to arbitrary file system read, potentially allowing a remote attacker to access files outside the intended directory without logging in and without user interaction.
What Is It
CVE-2026-121351 is an Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability (CWE-22) in Adobe Connect. Adobe reported it, and NVD published it on November 10, 2026. NVD currently lists the record as "Received."
According to the vendor description, the flaw "could lead to arbitrary file system read." Adobe says an attacker could exploit it to "access sensitive files and directories outside the intended access scope."
Why It Matters
Adobe scored this issue 10.0 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In practice that means:
- Network-reachable: it can be exploited remotely.
- Low complexity: no special conditions are needed.
- No privileges required: the attacker does not need to log in.
- No user interaction: nobody has to click anything.
- Scope changed: the impact reaches beyond the vulnerable component.
- High confidentiality and integrity impact, no availability impact.
Adobe Connect servers are often exposed to the internet to host meetings, so an unauthenticated file-read flaw at this severity deserves quick attention.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. KEV does not currently confirm active exploitation, and no CISA-mandated required action is listed.
What's Vulnerable
Adobe lists the following Adobe Connect release lines as affected:
| Affected (up to and including) | First unaffected version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
The NVD record does not list any CPEs.
Patch Status
Adobe has published fixed builds for each affected release line (see the table above), and the NVD record references Adobe security bulletin APSB26-191. Organizations running Adobe Connect should:
- Find their deployed version.
- Upgrade to the fixed build for that release line (12.8.a, 12.9.a, 12.10.f, 12.11.i, or 12.12.a), or later.
- Read APSB26-191 for Adobe's full remediation guidance.
Because exploitation needs no authentication, internet-facing instances should be patched first.