ADOBE CONNECT · CVE-2026-121890 · Vendor
FIX → 12.12.a +4 ✓ verified
Adobe Connect on Windows (12.12 and earlier) has an XML external entity flaw (CWE-611, CVSS 7.7). A logged-in low-privileged user can read files and directories outside the intended scope. No user interaction is needed. Adobe fixed it in APSB26-191 on 2026-11-10 (priority 2) and is not aware of exploitation.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations that run Adobe Connect, including self-hosted deployments, are exposed to file reads on the server. The sources do not state which versions or configurations are affected, so the unknown fields below remain unknown.
Not affected if auth-required, unknown
Who cares adobe-connect, auth-required, self-hosted, windows, xxe
Upgrade to 12.12.a +4
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.