{"id":"CVE-2026-121353","kind":"vulnerability","aliases":["CVE-2026-121353"],"related":[],"title":"Adobe Connect on Windows: CRLF injection, no login needed, can escalate privileges (fixed in APSB26-191)","description":"Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe's APSB26-191 (Nov 10, 2026) fixes a critical CRLF injection (CWE-93) in Adobe Connect, CVE-2026-121353, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Adobe lists the impact as privilege escalation and the attacker needs no account. Adobe says it is not aware of exploits in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-connect","crlf-injection","self-hosted","vendor","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your self-hosted Adobe Connect server version on Windows. Affected per Adobe: 12.12 and earlier. If your branch is below its fixed build (12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a) you are exposed. Also check any non-Windows Connect install: the bulletin lists Windows only.","fix":"Install the Adobe Connect update for your branch on Windows: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, per APSB26-191.","status":"open","published_at":"2026-11-10T22:18:25+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:28:27+00:00","updated_at":"2026-11-10T22:34:37+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: CRLF injection lets attackers run code as the user","impact":"high","summary":"Adobe Connect fails to neutralize CRLF sequences in input, a flaw classed as CRLF injection. The description says an attacker can run code in the current user's context and take over the account or session without user interaction.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Code runs as the user, session and account can be taken over","analyst_note":"Find Adobe's security bulletin for CVE-2026-121353 to confirm affected versions, fixed versions and whether it is exploited; the NVD entry alone gives no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"Adobe Connect","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name Adobe Connect only and do not say which deployments, versions or configurations are exposed. Teams that run Adobe Connect servers or use hosted Adobe Connect should look for vendor guidance. unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00069,"input_tokens":4571,"output_tokens":466,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for CVE-2026-121353 to confirm affected versions, fixed versions and whether it is exploited; the NVD entry alone gives no product ranges.","search":"'-121353':19A,22A,55B '-191':16A,39B '-2026':18A,21A,54B '-93':49B '10':41B '10.0':57B '2026':42B 'access':122C 'account':79B,129C 'adob':1A,26B,36B,51B,67B,80B,91C 'adobe':23A 'adobe-connect':25B 'affect':94C 'apsb26':15A,38B 'arbitrari':109C 'attack':76B 'av':58B 'awar':85B 'c/c':63B 'chang':143C 'code':110C 'connect':2A,24A,27B,52B,92C 'context':114C 'control':124C 'could':106C 'critic':45B 'crlf':5A,29B,46B,100C,102C 'crlf-inject':28B 'current':117C 'cve':17A,20A,53B 'cvss':56B 'cwe':48B 'elev':121C 'escal':11A,73B 'execut':111C 'exploit':87B,132C 'fix':13A,43B 'gain':120C 'h/a':65B 'h/i':64B 'host':33B 'impact':70B 'improp':97C 'inject':6A,30B,47B,103C 'interact':140C 'issu':135C 'l/pr':60B 'list':68B 'login':8A 'n':66B 'n/ac':59B 'n/s':62B 'n/ui':61B 'need':9A,77B 'neutral':98C 'nov':40B 'potenti':119C 'privileg':12A,72B 'requir':138C 'result':107C 'say':81B 'scope':141C 'self':32B 'self-host':31B 'sequenc':101C 'session':131C 'user':118C,139C 'vendor':34B 'victim':127C 'vulner':104C 'wild':90B 'window':4A,35B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Adobe Connect on Windows, version 12.12 or earlier, per APSB26-191. Adobe's vector is network, no privileges, no user interaction, so any reachable Connect server is in scope. The bulletin does not say whether Adobe-hosted Connect needed action.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:34:37Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3000},"products":{"at":"2026-11-10T22:34:37Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3000},"how_to_check":{"at":"2026-11-10T22:34:37Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3000},"who_affected":{"at":"2026-11-10T22:34:37Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3000}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","crlfinjection","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-121353':19A,22A '-191':16A '-2026':18A,21A 'adob':1A 'adobe':23A 'apsb26':15A 'connect':2A,24A 'crlf':5A 'cve':17A,20A 'escal':11A 'fix':13A 'inject':6A 'login':8A 'need':9A 'privileg':12A 'window':4A","search_b":"'-121353':55B '-191':39B '-2026':54B '-93':49B '10':41B '10.0':57B '2026':42B 'account':79B 'adob':26B,36B,51B,67B,80B 'adobe-connect':25B 'apsb26':38B 'attack':76B 'av':58B 'awar':85B 'c/c':63B 'connect':27B,52B 'critic':45B 'crlf':29B,46B 'crlf-inject':28B 'cve':53B 'cvss':56B 'cwe':48B 'escal':73B 'exploit':87B 'fix':43B 'h/a':65B 'h/i':64B 'host':33B 'impact':70B 'inject':30B,47B 'l/pr':60B 'list':68B 'n':66B 'n/ac':59B 'n/s':62B 'n/ui':61B 'need':77B 'nov':40B 'privileg':72B 'say':81B 'self':32B 'self-host':31B 'vendor':34B 'wild':90B 'window':35B","search_c":"'access':122C 'account':129C 'adob':91C 'affect':94C 'arbitrari':109C 'chang':143C 'code':110C 'connect':92C 'context':114C 'control':124C 'could':106C 'crlf':100C,102C 'current':117C 'elev':121C 'execut':111C 'exploit':132C 'gain':120C 'improp':97C 'inject':103C 'interact':140C 'issu':135C 'neutral':98C 'potenti':119C 'requir':138C 'result':107C 'scope':141C 'sequenc':101C 'session':131C 'user':118C,139C 'victim':127C 'vulner':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121353","severity":null,"published_at":"2026-11-10T22:18:25+00:00","modified_at":"2026-11-10T22:18:25+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121353:3000","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:34:37+00:00","modified_at":"2026-11-10T22:34:37+00:00","first_seen_at":"2026-11-10T22:34:37+00:00","fetched_at":"2026-11-10T22:34:37+00:00","note":"Read Adobe APSB26-191: CVE-2026-121353 CRLF injection, CVSS 10.0 PR:N, impact privilege escalation, Windows 12.12 and earlier, not exploited per Adobe. Triage's 'run code' wording came from NVD, Adobe lists privilege escalation. No PoC/social searched.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}