Adobe has disclosed a critical path traversal vulnerability in Adobe Connect that could let an authenticated attacker read arbitrary files outside the intended directory scope, with no user interaction required.
What Is It
CVE-2026-121906 is a path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in Adobe Connect. Adobe's description says the flaw "could lead to arbitrary file system read." An attacker could use it to reach sensitive files and directories outside the intended access scope.
Adobe PSIRT submitted the record and NVD published it on 2026-11-10. Its NVD status is currently "Received," which means NVD has not finished analyzing it yet.
Why It Matters
Adobe scored the flaw 9.9 (Critical) under CVSS 3.1 with this vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In practice, that vector means:
- Network-exploitable with low attack complexity
- Low privileges are needed, so the attacker must be authenticated
- No user interaction is needed
- Scope is changed: the impact can reach resources beyond the vulnerable component
- Confidentiality, integrity and availability impact are all rated High
The written description only talks about arbitrary file reads, but the CVSS vector also rates integrity and availability impact as High. Defenders should plan around the higher of the two ratings until Adobe or NVD says more.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. As of this writing, KEV does not confirm active exploitation.
What's Vulnerable
Adobe Connect is affected across several release branches. Per the vendor data:
| Affected (up to and including) | Fixed version |
|---|---|
| 12.8 | 12.8.a |
| 12.9 | 12.9.a |
| 12.10 | 12.10.f |
| 12.11 | 12.11.i |
| 12.12 | 12.12.a |
The NVD record does not list any CPE entries yet.
Patch Status
Adobe has published fixed builds for each affected branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Details are in security bulletin APSB26-191. Because no KEV entry exists, CISA has set no required action or due date.
Organizations running Adobe Connect should:
- Move to the fixed build for their branch.
- Treat this as a high priority, given the critical score, network attack vector and low privilege requirement.
- Check the Adobe bulletin for any further guidance.