Adobe Connect has a critical SQL injection flaw (CVSS 9.4) that a remote attacker can exploit without logging in or needing anyone to click anything, and Adobe says it could lead to arbitrary code execution.
What Is It
CVE-2026-121902 is a SQL injection vulnerability (CWE-89) in Adobe Connect. Adobe reported it, and NVD published it on 2026-11-10. NVD still lists the record as "Received". According to the vendor description, an attacker can use the flaw to run arbitrary SQL commands, which could result in arbitrary code execution. That puts the confidentiality, integrity and availability of the application at risk.
Why It Matters
Adobe scored it 9.4 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. In plain terms:
- Network attack vector: it can be exploited remotely.
- Low attack complexity: no special conditions are needed.
- No privileges required: the attacker does not need to be logged in.
- No user interaction: nobody has to click a link or open a file.
- High impact on confidentiality and integrity, low impact on availability.
Remote, unauthenticated access combined with possible code execution makes exposed Adobe Connect servers a high-priority patch target.
Exploitation status: No CISA KEV entry was supplied for this CVE, so CISA has not confirmed active exploitation. The sources contain no exploitation evidence either way. Watch for a KEV addition.
What's Vulnerable
The NVD affected-version data lists these Adobe Connect branches:
| Branch | Affected | Unaffected |
|---|---|---|
| 12.8 | ≤ 12.8 | 12.8.a |
| 12.9 | ≤ 12.9 | 12.9.a |
| 12.10 | ≤ 12.10 | 12.10.f |
| 12.11 | ≤ 12.11 | 12.11.i |
| 12.12 | ≤ 12.12 | 12.12.a |
NVD has not published CPE entries yet.
Patch Status
The bulletin ID linked to this CVE is APSB26-191 (Adobe Connect). The vendor's affected data lists fixed versions for each branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Administrators should move to the fixed version for their branch. Before upgrading, find APSB26-191 in Adobe's official security bulletin index on helpx.adobe.com to confirm the upgrade guidance. The bulletin link in the sources below does not use Adobe's usual bulletin URL format, so do not rely on it alone.
There is no CISA KEV required action or due date for this CVE.