---
id: "CVE-2026-121351"
page: "https://infrastack.ai/live/CVE-2026-121351"
kind: "vulnerability"
aliases: ["CVE-2026-121351"]
title: "Adobe Connect on Windows: unauthenticated path traversal, CVSS 10.0 (fixed in APSB26-191)"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Connect", "fixed": ["12.12.a", "12.11.i", "12.10.f", "12.9.a", "12.8.a"], "affected": "<= 12.12 (Windows)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-connect", "no-auth", "self-hosted", "vendor", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T22:18:24+00:00"
first_seen_at: "2026-11-10T22:27:26+00:00"
updated_at: "2026-11-10T22:34:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121351", "first_seen_at": "2026-11-10T22:27:26+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "first_seen_at": "2026-11-10T22:34:47+00:00", "cites": ["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}]
exploit_sources: []
---

# Adobe Connect on Windows: unauthenticated path traversal, CVSS 10.0 (fixed in APSB26-191)

Link for people: https://infrastack.ai/live/CVE-2026-121351 (this .md is for agents)

Adobe's bulletin APSB26-191 (Nov 10, 2026) lists CVE-2026-121351 as a critical path traversal (CWE-22), CVSS 10.0, network-reachable with no privileges and no user interaction (AV:N/PR:N/UI:N, scope changed, high confidentiality and integrity impact). Adobe labels the impact 'privilege escalation'. Adobe is not aware of exploits in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect affected <= 12.12 (Windows) fixed 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## How to check

Self-hosted Adobe Connect on Windows: check the installed version. Affected: 12.12 and earlier. Fixed builds: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. If your server is on an earlier build than the one for your release line, you are exposed. The bulletin lists Windows only; also check if you run Connect on another platform, which the bulletin does not cover.

## Fix

Install the APSB26-191 update for your release line: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows).

## Timeline

- 2026-11-10T22:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121351
- 2026-11-10T22:34:47+00:00 analyst https://www.adobe.com/trust/security/products/connect/apsb26-191.html — Read Adobe APSB26-191: affected 12.12 and earlier on Windows, fixed builds listed, PR:N so no auth; no exploitation known per Adobe. Title changed from file-read to match Adobe's labeling. Sibling CVEs share this bulletin.

## Documents

- [advisory] APSB26-191 Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-191.html

## From the sources

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_