CVE-2026-121352 is an incorrect authorization flaw in Adobe Connect, rated CVSS 10.0 (critical). According to the vendor description, it could result in privilege escalation and unauthorized access to sensitive resources. The CVSS vector rates it as exploitable over the network, with no privileges and no user interaction required.
What Is It
Adobe's PSIRT disclosed CVE-2026-121352 and classified it as Incorrect Authorization (CWE-863) in Adobe Connect. According to the NVD description, the flaw "could result in privilege escalation," and an attacker could use it to "gain unauthorized access to sensitive resources." Adobe says exploitation does not require user interaction and that the scope is changed.
NVD published the record on 2026-11-10. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: it needs no special conditions.
- No privileges required: the attacker does not need to log in.
- No user interaction: no victim has to click anything.
- Scope changed: the impact can reach beyond the vulnerable component.
- High confidentiality and integrity impact: data can be read and changed. Availability is not affected.
These factors together produce the maximum base score of 10.0. Adobe Connect is a web conferencing platform, so organizations with internet-facing deployments should treat this as a high priority.
Exploitation status: CVE-2026-121352 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
Adobe's affected-version data lists these Adobe Connect release lines:
| Release line | Affected | Listed as unaffected |
|---|---|---|
| 12.8 | ≤ 12.8 | 12.8.a |
| 12.9 | ≤ 12.9 | 12.9.a |
| 12.10 | ≤ 12.10 | 12.10.f |
| 12.11 | ≤ 12.11 | 12.11.i |
| 12.12 | ≤ 12.12 | 12.12.a |
The NVD record does not list any CPEs yet.
Patch Status
Adobe has published security bulletin APSB26-191 for Adobe Connect. The affected-version data names a fixed build for each supported line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a.
Because this is not a KEV entry, CISA has not set a required action or due date. Administrators should:
- Check the Adobe bulletin for update instructions.
- Move each Connect deployment to the fixed build for its release line.
- Patch internet-facing instances first, because the CVSS vector rates the flaw as exploitable without authentication or user interaction.