ADOBE CONNECT · CVE-2026-121351 · Vendor
FIX → 12.12.a +4 ✓ verified
Adobe's bulletin APSB26-191 (Nov 10, 2026) lists CVE-2026-121351 as a critical path traversal (CWE-22), CVSS 10.0, network-reachable with no privileges and no user interaction (AV:N/PR:N/UI:N, scope changed, high confidentiality and integrity impact). Adobe labels the impact 'privilege escalation'. Adobe is not aware of exploits in the wild.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations that run Adobe Connect servers are the ones exposed, since the flaw is in the server-side file handling. The sources do not name affected versions or configurations, so unknown.
Not affected if managed-hosting
Who cares adobe-connect, no-auth, self-hosted, windows
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.12.a +4
Install the APSB26-191 update for your release line: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows).