Adobe Security Bulletin

Last updated on Nov 10, 2026

Security update available for Adobe Connect | APSB26-191

Bulletin ID

Date published

Priority

APSB26-191

November 10, 2026

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe Connect. This update addresses vulnerabilities rated critical, high, and medium that could result in privilege escalation, arbitrary code execution, memory exposure, and arbitrary file system read.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Connect

12.12 and earlier

Windows

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Connect

12.12.a

12.11.i

12.10.f

12.9.a

12.8.a

Windows

Release Notes

style

grid width 12

Vulnerability Details

CVE-2026-121356

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121351

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121889

CVE-2026-121352

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121353

Vulnerability category: Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121354

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-121887

Vulnerability category: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-121892

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-121894

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-121896

CVE-2026-121898

CVE-2026-121906

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-121908

CVE-2026-121349

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121900

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE-2026-121902

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE-2026-122102

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE-2026-121355

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-121913

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-121904

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVE-2026-121350

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Memory exposure
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2026-121890

Vulnerability category: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Vulnerability impact: Arbitrary file system read
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2026-121910

Vulnerability category: Cross-site Scripting (XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVE-2026-121912

Vulnerability category: Cross-site Scripting (XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

edra — CVE-2026-121351, CVE-2026-121889, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121887, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121349, CVE-2026-121900, CVE-2026-121355, CVE-2026-121350, CVE-2026-121890
Jim Green (green-jam) — CVE-2026-121906, CVE-2026-121908, CVE-2026-121902, CVE-2026-121910, CVE-2026-121912
archyxsec — CVE-2026-121904
Diego (goedix) — CVE-2026-122102

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-191

CardDescription

Priority 2 Security update

CardImage

Created

2026-11-10

General information

Careers

Trust Center

Corporate responsibility

Legal

Security

Responsible AI

Accessibility

Transparency Center

Compliance

Privacy

Fraud Prevention

Adobe Security Bulletin

Last updated on Nov 10, 2026

Summary

Affected Versions

Solution

Vulnerability Details

Acknowledgments