---
id: "CVE-2026-121349"
page: "https://infrastack.ai/live/CVE-2026-121349"
kind: "vulnerability"
aliases: ["CVE-2026-121349"]
title: "Adobe Connect 12.12 and earlier on Windows: path traversal (CVE-2026-121349), fixed in APSB26-191"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Connect", "fixed": ["12.12.a", "12.11.i", "12.10.f", "12.9.a", "12.8.a"], "affected": "<= 12.12 (Windows)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-connect", "on-premise", "other", "path-traversal", "self-hosted", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T22:18:24+00:00"
first_seen_at: "2026-11-10T22:27:26+00:00"
updated_at: "2026-11-10T22:35:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121349", "first_seen_at": "2026-11-10T22:27:26+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "first_seen_at": "2026-11-10T22:35:52+00:00", "cites": ["https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}]
exploit_sources: []
---

# Adobe Connect 12.12 and earlier on Windows: path traversal (CVE-2026-121349), fixed in APSB26-191

Link for people: https://infrastack.ai/live/CVE-2026-121349 (this .md is for agents)

Adobe fixed a critical path traversal (CWE-22, CVSS 9.6) in Adobe Connect on Windows in bulletin APSB26-191 (Nov 10 2026). It needs a low-privileged account and no user interaction. Adobe lists the impact as privilege escalation (not code execution). Adobe is not aware of exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect affected <= 12.12 (Windows) fixed 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## How to check

Check your self-hosted Adobe Connect server version. If it is 12.12 or earlier on Windows and not on 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (matching your release line) or later, you are exposed. Also check Connect on other platforms: the bulletin lists only Windows.

## Fix

Install the Adobe Connect patch from the on-premise patch page for your release line: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows).

## Timeline

- 2026-11-10T22:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121349
- 2026-11-10T22:35:52+00:00 analyst https://www.adobe.com/trust/security/products/connect/apsb26-191.html — Read Adobe APSB26-191 (primary): CVE-2026-121349 listed as path traversal, impact privilege escalation, CVSS 9.6, PR:L; affected 12.12 and earlier Windows; fixes per line. Title corrected from code execution to match Adobe's impact. Hosted-service status not stated in bulletin; who_affected/how_to_check not verified. No social search.

## Documents

- [advisory] APSB26-191 Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-191.html
- [fix] Find on-premise patch files for Adobe Connect 9-12 https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html

## From the sources

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_