Adobe has disclosed CVE-2026-121898, a critical SQL injection flaw (CVSS 9.9) in Adobe Connect. A low-privileged attacker could use it to execute arbitrary code, and no user interaction is needed.
What Is It
CVE-2026-121898 is an SQL injection flaw in Adobe Connect (CWE-89, improper neutralization of special elements used in an SQL command). Adobe PSIRT says it could lead to arbitrary code execution in the context of the current user. An attacker needs only low privileges to exploit it, and no user interaction is required.
NVD published the record on November 10, 2026, with the status "Received." That means NVD has not yet completed its own analysis.
Why It Matters
Adobe scored this flaw 9.9 (CRITICAL) under CVSS 3.1, with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: An attacker can exploit it remotely, and the attack is not complex.
- Low barrier: Any authenticated, low-privileged account is enough. No victim has to click anything.
- Scope changed: A successful exploit can reach resources outside the vulnerable component's security scope.
- Full impact: Confidentiality, integrity and availability are all rated High.
Adobe Connect is a web conferencing platform, so it is often exposed to many authenticated users. In multi-user deployments, the low privilege requirement makes this especially serious.
Exploitation status: CVE-2026-121898 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Active exploitation is not confirmed at this time.
What's Vulnerable
According to Adobe's affected-version data, these Adobe Connect release lines are vulnerable:
| Release line | Affected | First fixed version |
|---|---|---|
| 12.8 | Up to and including 12.8 | 12.8.a |
| 12.9 | Up to and including 12.9 | 12.9.a |
| 12.10 | Up to and including 12.10 | 12.10.f |
| 12.11 | Up to and including 12.11 | 12.11.i |
| 12.12 | Up to and including 12.12 | 12.12.a |
Patch Status
Adobe has released fixed versions for every affected release line and lists them in security bulletin APSB26-191. Organizations running Adobe Connect should upgrade to the fixed build for their release line: 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a.
Because the CVE is not in the CISA KEV catalog, there is no federal required action or due date for it. The flaw is critical and needs only low privileges to exploit, so treat patching as a priority anyway, especially for instances reachable from the internet.