Adobe Connect has a critical XML External Entity (XXE) vulnerability, rated CVSS 9.9. According to Adobe, a low-privileged attacker could exploit it over the network to run arbitrary code, with no user interaction required.
What Is It
CVE-2026-121887 is an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) in Adobe Connect. Adobe's PSIRT says that exploiting it could lead to arbitrary code execution in the context of the current user. The attacker needs only low privileges, and no user interaction is required. The CVE record was published to NVD on 2026-11-10 and is currently in "Received" status.
Why It Matters
Adobe gives the flaw a CVSS 3.1 base score of 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable with low attack complexity
- Low privileges required and no user interaction
- Scope changed: impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
Based on this scoring, any authenticated low-privilege account could be enough to compromise an exposed Connect deployment.
As of publication, CVE-2026-121887 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. CISA has therefore not confirmed active exploitation, and there is no KEV required action or due date.
What's Vulnerable
Adobe lists affected Adobe Connect versions across several release branches. Each branch has its own fixed version:
| Affected (up to and including) | Unaffected version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
The default status for versions not listed is "unaffected." NVD has not published any CPE matches yet.
Patch Status
Adobe has fixed versions available, listed in security bulletin APSB26-191. Administrators should move each Connect deployment to the fixed release for its branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a. Check the Adobe bulletin for authoritative upgrade guidance. Because the attack needs low privileges and no user interaction, treat internet-facing Connect instances as the highest priority for patching.