Adobe Connect has a critical server-side request forgery (SSRF) vulnerability, rated CVSS 10.0. Adobe says it "could result in privilege escalation." According to the CVSS vector, an unauthenticated attacker could exploit it over the network without user interaction.
What Is It
CVE-2026-121889 is a server-side request forgery (SSRF) vulnerability (CWE-918) in Adobe Connect. Adobe's PSIRT reported it, and NVD published it on 2026-11-10. NVD status is currently "Received." Adobe's description says the flaw "could result in privilege escalation," that exploitation "does not require user interaction," and that the scope is changed. Adobe's public description gives no further technical detail on how the flaw would be exploited.
Why It Matters
Adobe gives the flaw the maximum CVSS 3.1 base score of 10.0 (CRITICAL). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. The vector rates the flaw as follows:
- Network-reachable, low complexity: an attacker could exploit it remotely with no special conditions.
- No privileges or user interaction required: an attacker would not need to log in or trick a user.
- Scope changed: a successful attack could affect resources beyond the vulnerable component itself.
- High confidentiality and integrity impact: there is no rated impact on availability.
These ratings come from the vendor's CVSS assessment. They do not describe a confirmed exploit.
The CISA KEV record supplied for this brief has no entry for this CVE. KEV does not currently confirm active exploitation. This brief has no other source on whether the flaw is being exploited in the wild. Still, the CVE is new, it has the highest possible score, and it is rated as needing no authentication, so organizations running Adobe Connect should make it a priority.
What's Vulnerable
Adobe lists the following Adobe Connect release lines as affected:
| Affected (up to and including) | Fixed / Unaffected Version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
NVD has not yet listed any CPE entries for this CVE.
Patch Status
Adobe lists a fixed version for each affected release line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Adobe has assigned this vulnerability to security bulletin APSB26-191. Administrators should move to the fixed version for their release line and follow the official remediation guidance in that bulletin.
The bulletin link below does not follow the URL pattern Adobe normally uses for its security bulletins. If it does not resolve, search Adobe's Product Security Incident Response Team (PSIRT) security bulletins index for APSB26-191.
CISA has not set a required action or a remediation deadline because the CVE is not currently in the KEV catalog.
Sources
- Adobe Security Bulletin APSB26-191 (Adobe Connect) (URL not verified; if it does not resolve, see the Adobe security bulletins index below)
- Adobe Product Security Incident Response Team: Security Bulletins and Advisories
- NVD: CVE-2026-121889
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)