Adobe Connect has a critical SQL injection flaw (CVSS 9.9) that lets a low-privileged attacker run arbitrary SQL commands over the network without any user interaction. Adobe says this could lead to arbitrary code execution.
What Is It
CVE-2026-121894 is a SQL injection weakness (CWE-89) in Adobe Connect. In its NVD description, Adobe says the flaw "could result in arbitrary code execution in the context of the current user." A low-privileged attacker could use it to run arbitrary SQL commands and possibly gain elevated access to, or control of, a victim's account or session.
Adobe PSIRT submitted the record to NVD, which published it on 2026-11-10. Its NVD status is currently "Received."
Why It Matters
Adobe scores this flaw CVSS 3.1 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Here is what that score means:
- Network-reachable with low attack complexity
- An attacker needs only low privileges, so any authenticated low-level account could be enough
- No user interaction is needed
- Scope is changed, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
Adobe Connect is a web conferencing platform, so attackers can usually reach it over the network. A low-privileged account is all it takes to reach the vulnerable code.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. Nothing in the supplied material confirms active exploitation in the wild, and CISA has not set a KEV remediation deadline.
What's Vulnerable
Adobe lists these Adobe Connect release lines as affected. Each line has a fixed build:
| Release line | Affected | Unaffected (fixed) |
|---|---|---|
| 12.8 | ≤ 12.8 | 12.8.a |
| 12.9 | ≤ 12.9 | 12.9.a |
| 12.10 | ≤ 12.10 | 12.10.f |
| 12.11 | ≤ 12.11 | 12.11.i |
| 12.12 | ≤ 12.12 | 12.12.a |
The NVD record lists no CPE entries yet.
Patch Status
Adobe has published security bulletin APSB26-191 for this issue. Its version data marks fixed builds as unaffected for every listed release line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a.
Recommended action: Find your Adobe Connect deployments. Upgrade each one to the fixed build for its release line, and use bulletin APSB26-191 to confirm. The flaw is critical, reachable over the network and needs only low privileges, so organizations running Adobe Connect should patch it soon, even though KEV does not list it.
Sources
- Adobe Security Bulletin APSB26-191 (Adobe Connect)
- NVD: CVE-2026-121894
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)