Adobe has disclosed CVE-2026-121896, a critical SQL injection flaw in Adobe Connect (CVSS 9.9) that a low-privileged attacker could use to execute arbitrary code without any user interaction.
What Is It
CVE-2026-121896 is a SQL injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) in Adobe Connect. According to Adobe's description, successful exploitation could result in arbitrary code execution in the context of the current user. The vendor states that exploitation does not require user interaction and that the scope is changed.
Adobe PSIRT published the record on 2026-11-10. Its NVD status is currently "Received," which means NVD has not yet analyzed it independently.
Why It Matters
Adobe scores the flaw at 9.9 (Critical) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-exploitable with low attack complexity
- Requires only low privileges, with no user interaction
- Changed scope, so impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
Any authenticated user with minimal access may be enough to reach code execution. This raises the risk for Connect deployments that have large or loosely managed user populations.
As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV has not confirmed active exploitation at this time.
What's Vulnerable
Adobe lists the following Adobe Connect release lines as affected, along with the first unaffected build for each:
| Affected (up to and including) | First unaffected version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
No CPE entries have been published in the NVD record yet.
Patch Status
Adobe has published fixed builds for every affected release line, as shown above. Adobe's security bulletin APSB26-191 is the vendor reference. Organizations running Adobe Connect should upgrade to the fixed version for their release line (12.8.a, 12.9.a, 12.10.f, 12.11.i, or 12.12.a) and check the bulletin for vendor guidance. Adobe usually publishes its security bulletins on helpx.adobe.com. If the link in the CVE record does not resolve, look up APSB26-191 on Adobe's Product Security Incident Response Team (PSIRT) bulletin page.
Because this CVE is not listed in the CISA KEV catalog, there is no CISA-mandated required action or due date for it. Given the critical severity and low exploitation barrier, patching should still be a priority.