Adobe Connect has a CVSS 10.0 server-side request forgery (SSRF) flaw that an unauthenticated attacker could use over the network to escalate privileges, without any user interaction.
What Is It
CVE-2026-121356 is a Server-Side Request Forgery vulnerability (CWE-918) in Adobe Connect. Adobe reported it through its PSIRT, and NVD published the record on November 10, 2026. Adobe describes the flaw as one that "could result in privilege escalation." Exploitation does not require user interaction, and the scope is changed. That means a successful attack can affect resources beyond the vulnerable component itself. NVD lists the record's status as "Received," so NVD has not yet completed its own analysis.
Why It Matters
Adobe gives this flaw a CVSS v3.1 base score of 10.0 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, high integrity, no availability impact
For internet-facing collaboration servers, an unauthenticated attacker who can reach the server, with no user interaction and low attack complexity, is among the most serious risk profiles. The changed scope means a compromise could reach systems beyond Connect itself.
The supplied data contains no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE, so active exploitation is not confirmed. Because of the severity, defenders should still prioritize it.
What's Vulnerable
The affected Adobe Connect versions and their fixed releases are:
| Affected Versions | First Fixed Version |
|---|---|
| 12.8 and earlier | 12.8.a |
| 12.9 and earlier | 12.9.a |
| 12.10 and earlier | 12.10.f |
| 12.11 and earlier | 12.11.i |
| 12.12 and earlier | 12.12.a |
The supplied NVD record contains no CPE configuration data.
Patch Status
Adobe has released fixes, which are referenced in security bulletin APSB26-191. Administrators should upgrade each Adobe Connect deployment to the fixed release for its version line: 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a. Check Adobe's bulletin for deployment guidance and any updated version information.
There is no KEV listing, so no CISA-mandated remediation deadline applies right now. If CISA adds this CVE to the KEV catalog later, federal agencies will have a required action and due date.