---
id: "CVE-2026-121354"
page: "https://infrastack.ai/live/CVE-2026-121354"
kind: "vulnerability"
aliases: ["CVE-2026-121354"]
title: "Adobe Connect 12.12 and earlier on Windows: path traversal (CVE-2026-121354), fixed in APSB26-191"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Connect", "fixed": ["12.12.a", "12.11.i", "12.10.f", "12.9.a", "12.8.a"], "affected": "<= 12.12 (Windows)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-connect", "on-premise", "path-traversal", "self-hosted", "vendor", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T22:18:25+00:00"
first_seen_at: "2026-11-10T22:27:26+00:00"
updated_at: "2026-11-10T22:34:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121354", "first_seen_at": "2026-11-10T22:27:26+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "first_seen_at": "2026-11-10T22:34:48+00:00", "cites": ["https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}]
exploit_sources: []
---

# Adobe Connect 12.12 and earlier on Windows: path traversal (CVE-2026-121354), fixed in APSB26-191

Link for people: https://infrastack.ai/live/CVE-2026-121354 (this .md is for agents)

Adobe fixed a critical path traversal (CWE-22, CVSS 9.9) in Adobe Connect on Windows in bulletin APSB26-191 (Nov 10 2026). It needs a low-privileged account and no user interaction. NVD describes arbitrary file system read; Adobe's bulletin lists the impact as arbitrary code execution. Adobe is not aware of exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect affected <= 12.12 (Windows) fixed 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## How to check

Check your Adobe Connect on-premise server version. If it is 12.12 or earlier on Windows and not at 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (or later), you are exposed. Also check if you run Connect on other platforms: the bulletin lists only Windows.

## Fix

Install the Adobe Connect patch from the on-premise patch page: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, matching your release line (Windows).

## Timeline

- 2026-11-10T22:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121354
- 2026-11-10T22:34:48+00:00 analyst https://www.adobe.com/trust/security/products/connect/apsb26-191.html — Read Adobe APSB26-191 (primary). Affected 12.12 and earlier Windows; fixed 12.12.a/12.11.i/12.10.f/12.9.a/12.8.a. Adobe lists impact as code execution vs NVD file read. No exploitation known. Hosted-service patching status not stated in the bulletin; not verified. No social search done.

## Documents

- [advisory] APSB26-191 Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-191.html
- [fix] Find on-premise patch files for Adobe Connect 9-12 https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html

## From the sources

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_