Adobe Connect has a critical SQL injection flaw (CVSS 9.9) that a low-privileged attacker can exploit over the network with no user interaction. Adobe says successful exploitation could lead to arbitrary code execution.
What Is It
CVE-2026-121908 is an SQL injection vulnerability (CWE-89, "Improper Neutralization of Special Elements used in an SQL Command") in Adobe Connect. Adobe's PSIRT says successful exploitation could lead to arbitrary code execution in the context of the current user.
The NVD record was published on 2026-11-10 and still has a "Received" status. That means NVD has not finished its own analysis, and the details below come from Adobe's submission.
Why It Matters
Adobe scores the flaw 9.9, which is Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The vector breaks down as follows:
- Network-reachable: an attacker can exploit it remotely.
- Low attack complexity: no special conditions are needed.
- Low privileges required: any authenticated, low-privileged account is enough.
- No user interaction: no victim has to click anything.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact on confidentiality, integrity and availability.
Adobe Connect is a web conferencing and collaboration platform. A remotely exploitable flaw that needs only a low-privileged account, and that Adobe says could lead to code execution, is a serious risk to exposed deployments.
There is no CISA KEV entry for this CVE at the time of writing. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
Adobe lists these Adobe Connect release lines as affected, along with the first fixed build in each:
| Affected versions | First unaffected version |
|---|---|
| 12.8 and earlier | 12.8.a |
| 12.9 and earlier | 12.9.a |
| 12.10 and earlier | 12.10.f |
| 12.11 and earlier | 12.11.i |
| 12.12 and earlier | 12.12.a |
The NVD record lists no CPEs yet.
Patch Status
Adobe has published fixed builds for each affected release line: 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a. Fix details are in Adobe security bulletin APSB26-191.
Because there is no KEV listing, CISA has issued no federal required action or due date. Given the critical score and the low bar to exploit, administrators should:
- Upgrade to the fixed build for their release line as soon as possible.
- Check that no Connect instance is still running 12.12 or earlier without the matching fix.
Sources
- Adobe Security Bulletin APSB26-191 (Adobe Connect)
- NVD: CVE-2026-121908
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of publication)