ADOBE CONNECT · CVE-2026-121887 · Other
FIX → 12.12.a +4 ✓ verified
Adobe Connect improperly restricts XML external entity references, a classic XXE flaw. A low-privileged attacker can execute arbitrary code in the context of the current user without any user interaction.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Adobe Connect servers on Windows, version 12.12 and earlier, that have not applied the November 2026 patch build. Any authenticated low-privileged user can reach the XXE flaw over the network with no user interaction, and Adobe rates it 9.9 with changed scope. Adobe-hosted Connect is not covered by this bulletin; the page does not say whether it is affected.
Not affected if managed-hosting
Who cares adobe-connect, self-hosted, windows, xxe
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.12.a +4
Apply the Adobe Connect patch build for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (APSB26-191, priority 2).