CVE-2026-121354 is a critical path traversal bug in Adobe Connect. A low-privileged remote attacker can use it to read files outside the intended directory, and no user interaction is needed.
What Is It
CVE-2026-121354 is a path traversal weakness (CWE-22, "Improper Limitation of a Pathname to a Restricted Directory") in Adobe Connect. Adobe reported it, and NVD published it on 2026-11-10. NVD currently lists its status as "Received."
The vendor description says an attacker can use the flaw to read arbitrary files on the file system. This includes sensitive files and directories outside the access scope the application intends. Exploitation does not require any user interaction, and the scope is changed.
Why It Matters
Adobe gives the flaw a CVSS 3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: the attack can be launched remotely.
- Low complexity: no special conditions are required.
- Low privileges: the attacker needs only a basic authenticated account.
- No user interaction: no victim has to click or open anything.
- Changed scope: the impact can reach resources beyond the vulnerable component.
The vector rates the impact on confidentiality, integrity and availability as High. The written description, however, mentions only arbitrary file system read.
Exploitation status: the supplied CISA KEV data has no entry for this CVE, so KEV does not confirm active exploitation at this time.
What's Vulnerable
Adobe's affected-version data covers five release branches of Adobe Connect. In each branch, the listed version and earlier are affected. The first fixed build is shown on the right:
| Affected branch | First unaffected version |
|---|---|
| 12.8 and earlier | 12.8.a |
| 12.9 and earlier | 12.9.a |
| 12.10 and earlier | 12.10.f |
| 12.11 and earlier | 12.11.i |
| 12.12 and earlier | 12.12.a |
The supplied NVD record lists no CPE entries.
Patch Status
Adobe has published security bulletin APSB26-191 for Adobe Connect. The affected-version data names a fixed build for each branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Administrators should read the bulletin and upgrade each Adobe Connect deployment to the fixed build for its branch.
Adobe usually publishes Connect security bulletins on its HelpX security portal (helpx.adobe.com/security/products/connect/). The HelpX link for APSB26-191 in the sources below follows that usual naming pattern, but the advisory data does not cite it and it has not been checked. Check that the bulletin is actually posted there before you rely on it, or go to the Connect bulletin index on the portal.
There is no CISA KEV entry, so no KEV required action or due date applies.