Adobe Connect has a CRLF injection flaw, CVE-2026-121353, which Adobe rates CVSS 10.0. An unauthenticated attacker can exploit it over the network with no user interaction, and it can lead to arbitrary code execution.
What Is It
CVE-2026-121353 is an Improper Neutralization of CRLF Sequences ("CRLF Injection") weakness in Adobe Connect, classified as CWE-93. Adobe's description says the flaw "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session."
Adobe PSIRT submitted the record, and NVD published it on 2026-11-10. NVD lists its status as "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Adobe gives this flaw the highest possible CVSS v3.1 base score: 10.0 (CRITICAL).
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, high integrity, no availability impact
A remote attacker needs no credentials and no help from a user. Because the scope is changed, a successful attack can affect resources beyond the vulnerable component, which matters for internet-facing Connect servers.
Exploitation status: CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. KEV has not confirmed active exploitation, and the source data includes no CISA required action or due date.
What's Vulnerable
Adobe lists affected Adobe Connect versions on each release line:
| Release line | Affected | First listed unaffected |
|---|---|---|
| 12.8 | ≤ 12.8 | 12.8.a |
| 12.9 | ≤ 12.9 | 12.9.a |
| 12.10 | ≤ 12.10 | 12.10.f |
| 12.11 | ≤ 12.11 | 12.11.i |
| 12.12 | ≤ 12.12 | 12.12.a |
NVD has not published CPE data for this record yet.
Patch Status
Adobe's affected-version data lists fixed builds for each supported line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Adobe's security bulletin APSB26-191 is the reference for this CVE. Administrators should check their Adobe Connect version against the table above, move to the matching unaffected build, and read the bulletin for the vendor's full remediation guidance.
The flaw is rated 10.0 and needs no authentication or user interaction, so Connect servers reachable from untrusted networks should be patched first.