Adobe has disclosed a critical code injection vulnerability (CVSS 9.9) in Adobe Connect. According to Adobe, successful exploitation could let a low-privileged attacker execute arbitrary code over the network without user interaction.
What Is It
CVE-2026-121892 is an Improper Control of Generation of Code ("Code Injection") vulnerability (CWE-94) in Adobe Connect. Adobe's PSIRT says that successful exploitation could lead to arbitrary code execution in the context of the current user. The flaw was published to NVD on 2026-11-10 and is currently in "Received" status.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity, and availability
Why It Matters
Based on the CVSS vector, an attacker who can reach the system over the network and holds only a low-privileged account would need no help from a victim to exploit this flaw. Because the scope is changed, a successful exploit could affect resources beyond the vulnerable component itself. That explains the high impact sub-score of 6.0 and an overall base score of 9.9 (Critical).
At the time of writing, this CVE has no CISA Known Exploited Vulnerabilities (KEV) entry, so the supplied data does not confirm active exploitation. Adobe Connect is a web conferencing platform, which makes it a target that organizations should patch quickly given the severity.
What's Vulnerable
Adobe lists the following Adobe Connect release lines as affected:
| Affected Versions | First Unaffected Version |
|---|---|
| 12.8 and earlier | 12.8.a |
| 12.9 and earlier | 12.9.a |
| 12.10 and earlier | 12.10.f |
| 12.11 and earlier | 12.11.i |
| 12.12 and earlier | 12.12.a |
Patch Status
Adobe has released fixed builds for every affected release line, as listed in security bulletin APSB26-191. Administrators should update Adobe Connect to the unaffected version for their line: 12.8.a, 12.9.a, 12.10.f, 12.11.i, or 12.12.a. Because no KEV entry exists, CISA has not issued a required action or federal remediation due date for this CVE.