{"id":"CVE-2026-121887","kind":"vulnerability","aliases":["CVE-2026-121887"],"related":[],"title":"Adobe Connect: XML external entity flaw allows code execution by low-privileged users","description":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Connect improperly restricts XML external entity references, a classic XXE flaw. A low-privileged attacker can execute arbitrary code in the context of the current user without any user interaction.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows), before patch builds 12.12.a / 12.11.i / 12.10.f / 12.9.a / 12.8.a","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","other","self-hosted","windows","xxe"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your on-premise Adobe Connect Windows server version in Connect Central/admin. Affected is 12.12 and earlier without the patch build for its branch (12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a). Adobe's bulletin lists Windows only; macOS is not listed.","fix":"Apply the Adobe Connect patch build for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (APSB26-191, priority 2).","status":"open","published_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:34+00:00","updated_at":"2026-11-10T22:33:43+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T22:28:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: XML external entity flaw allows code execution by low-privileged users","impact":"high","summary":"Adobe Connect improperly restricts XML external entity references, a classic XXE flaw. A low-privileged attacker can execute arbitrary code in the context of the current user without any user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary code runs as the current user on the server","analyst_note":"Find the affected Adobe Connect versions, the fixed build, and the Adobe security bulletin for this CVE; NVD entry lacks product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Connect servers are exposed to this flaw. The sources do not say which versions are affected, which deployment settings matter, or how an attacker reaches the service. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000669,"input_tokens":4571,"output_tokens":423,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Adobe Connect versions, the fixed build, and the Adobe security bulletin for this CVE; NVD entry lacks product ranges.","search":"'-121887':17A,20A '-2026':16A,19A 'adob':1A,24B,32B,64C 'adobe':21A 'adobe-connect':23B 'affect':67C 'allow':7A 'arbitrari':51B,83C,104C 'attack':48B,97C 'chang':117C 'classic':41B 'code':8A,52B,84C,105C 'connect':2A,22A,25B,33B,65C 'context':55B,88C 'could':80C,98C 'current':58B,91C 'cve':15A,18A 'entiti':5A,38B,75C 'execut':9A,50B,85C,103C 'exploit':99C,106C 'extern':4A,37B,74C 'flaw':6A,43B 'host':29B 'improp':34B,70C 'interact':63B,114C 'issu':109C 'low':12A,46B,95C 'low-privileg':11A,45B,94C 'privileg':13A,47B,96C 'refer':39B,76C 'requir':112C 'restrict':35B,71C 'result':81C 'scope':115C 'self':28B 'self-host':27B 'user':14A,59B,62B,92C,113C 'vulner':78C,101C 'window':30B 'without':60B 'xml':3A,36B,73C 'xxe':31B,42B,77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Adobe Connect servers on Windows, version 12.12 and earlier, that have not applied the November 2026 patch build. Any authenticated low-privileged user can reach the XXE flaw over the network with no user interaction, and Adobe rates it 9.9 with changed scope. Adobe-hosted Connect is not covered by this bulletin; the page does not say whether it is affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:33:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2996},"products":{"at":"2026-11-10T22:33:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2996},"how_to_check":{"at":"2026-11-10T22:33:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2996},"who_affected":{"at":"2026-11-10T22:33:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2996}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","other","selfhosted","windows","xxe"],"campaign_type":null,"search_a":"'-121887':17A,20A '-2026':16A,19A 'adob':1A 'adobe':21A 'allow':7A 'code':8A 'connect':2A,22A 'cve':15A,18A 'entiti':5A 'execut':9A 'extern':4A 'flaw':6A 'low':12A 'low-privileg':11A 'privileg':13A 'user':14A 'xml':3A","search_b":"'adob':24B,32B 'adobe-connect':23B 'arbitrari':51B 'attack':48B 'classic':41B 'code':52B 'connect':25B,33B 'context':55B 'current':58B 'entiti':38B 'execut':50B 'extern':37B 'flaw':43B 'host':29B 'improp':34B 'interact':63B 'low':46B 'low-privileg':45B 'privileg':47B 'refer':39B 'restrict':35B 'self':28B 'self-host':27B 'user':59B,62B 'window':30B 'without':60B 'xml':36B 'xxe':31B,42B","search_c":"'adob':64C 'affect':67C 'arbitrari':83C,104C 'attack':97C 'chang':117C 'code':84C,105C 'connect':65C 'context':88C 'could':80C,98C 'current':91C 'entiti':75C 'execut':85C,103C 'exploit':99C,106C 'extern':74C 'improp':70C 'interact':114C 'issu':109C 'low':95C 'low-privileg':94C 'privileg':96C 'refer':76C 'requir':112C 'restrict':71C 'result':81C 'scope':115C 'user':92C,113C 'vulner':78C,101C 'xml':73C 'xxe':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121887","severity":null,"published_at":"2026-11-10T22:18:26+00:00","modified_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121887:2996","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:33:43+00:00","modified_at":"2026-11-10T22:33:43+00:00","first_seen_at":"2026-11-10T22:33:43+00:00","fetched_at":"2026-11-10T22:33:43+00:00","note":"Read Adobe APSB26-191 (Nov 10 2026): CVE listed, XXE CWE-611, CVSS 9.9 PR:L, Windows only, no known exploitation. Fix = per-branch patch builds.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}