---
id: "CVE-2026-121353"
page: "https://infrastack.ai/live/CVE-2026-121353"
kind: "vulnerability"
aliases: ["CVE-2026-121353"]
title: "Adobe Connect on Windows: CRLF injection, no login needed, can escalate privileges (fixed in APSB26-191)"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Connect", "fixed": ["12.12.a", "12.11.i", "12.10.f", "12.9.a", "12.8.a"], "affected": "<= 12.12 (Windows)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-connect", "crlf-injection", "self-hosted", "vendor", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T22:18:25+00:00"
first_seen_at: "2026-11-10T22:27:26+00:00"
updated_at: "2026-11-10T22:34:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121353", "first_seen_at": "2026-11-10T22:27:26+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "first_seen_at": "2026-11-10T22:34:37+00:00", "cites": ["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}]
exploit_sources: []
---

# Adobe Connect on Windows: CRLF injection, no login needed, can escalate privileges (fixed in APSB26-191)

Link for people: https://infrastack.ai/live/CVE-2026-121353 (this .md is for agents)

Adobe's APSB26-191 (Nov 10, 2026) fixes a critical CRLF injection (CWE-93) in Adobe Connect, CVE-2026-121353, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Adobe lists the impact as privilege escalation and the attacker needs no account. Adobe says it is not aware of exploits in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect affected <= 12.12 (Windows) fixed 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## How to check

Check your self-hosted Adobe Connect server version on Windows. Affected per Adobe: 12.12 and earlier. If your branch is below its fixed build (12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a) you are exposed. Also check any non-Windows Connect install: the bulletin lists Windows only.

## Fix

Install the Adobe Connect update for your branch on Windows: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, per APSB26-191.

## Timeline

- 2026-11-10T22:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121353
- 2026-11-10T22:34:37+00:00 analyst https://www.adobe.com/trust/security/products/connect/apsb26-191.html — Read Adobe APSB26-191: CVE-2026-121353 CRLF injection, CVSS 10.0 PR:N, impact privilege escalation, Windows 12.12 and earlier, not exploited per Adobe. Triage's 'run code' wording came from NVD, Adobe lists privilege escalation. No PoC/social searched.

## Documents

- [advisory] APSB26-191 Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-191.html

## From the sources

Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_