ADOBE CONNECT · CVE-2026-121354 · Vendor
FIX → 12.12.a +4 ✓ verified
Adobe fixed a critical path traversal (CWE-22, CVSS 9.9) in Adobe Connect on Windows in bulletin APSB26-191 (Nov 10 2026). It needs a low-privileged account and no user interaction. NVD describes arbitrary file system read; Adobe's bulletin lists the impact as arbitrary code execution. Adobe is not aware of exploitation.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations that run Adobe Connect on their own infrastructure are the ones exposed. The sources do not state which Adobe Connect versions or deployment modes are affected, so the team should confirm the product range with Adobe before assuming exposure. unknown
Not affected if managed-hosting
Who cares adobe-connect, on-premise, path-traversal, self-hosted, windows
Upgrade to 12.12.a +4
Install the Adobe Connect patch from the on-premise patch page: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, matching your release line (Windows).
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.