CVE-2026-121355 is a critical (CVSS 9.1) incorrect authorization flaw in Adobe Connect that an unauthenticated attacker can exploit over the network to escalate privileges.
What Is It
CVE-2026-121355 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Connect. Adobe's description says the flaw "could result in privilege escalation" and that an attacker "could exploit this vulnerability to gain elevated access to sensitive information or functionality." Exploiting it does not require user interaction.
Adobe PSIRT reported the issue, and NVD published it on 2026-11-10. NVD's record status is currently "Received," which means it has not been fully analyzed yet.
Why It Matters
Adobe gives the flaw a CVSS 3.1 base score of 9.1 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. In practice, that means:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges required: the attacker does not need to be logged in.
- No user interaction: no victim has to click or do anything.
- High impact on confidentiality and integrity: sensitive data could be exposed or changed. Availability is not affected.
Adobe Connect is a web conferencing platform, and deployments are often exposed to the internet. A flaw that unauthenticated users can reach remotely is therefore a high priority to patch.
Exploitation status: The supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE. Active exploitation is not confirmed by KEV at the time of writing.
What's Vulnerable
According to the NVD/Adobe affected-version data, these Adobe Connect release lines are affected:
| Affected (up to and including) | Listed as unaffected |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
The supplied record lists no CPE entries.
Patch Status
Adobe has published security bulletin APSB26-191 for Adobe Connect. The affected-version data lists a fixed build for each release line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a.
Administrators should:
- Find out which Adobe Connect release line they are running.
- Upgrade to the matching fixed build listed above, or a later one.
- Check APSB26-191 for Adobe's official upgrade guidance.
Because no KEV entry exists, there is no CISA-mandated remediation deadline. Even so, a 9.1 score with no authentication required makes this worth patching quickly.