{"id":"CVE-2026-121890","kind":"vulnerability","aliases":["CVE-2026-121890"],"related":[],"title":"Adobe Connect: XML external entity flaw lets low-privileged users read server files","description":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Connect on Windows (12.12 and earlier) has an XML external entity flaw (CWE-611, CVSS 7.7). A logged-in low-privileged user can read files and directories outside the intended scope. No user interaction is needed. Adobe fixed it in APSB26-191 on 2026-11-10 (priority 2) and is not aware of exploitation.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","auth-required","self-hosted","vendor","windows","xxe"],"not_affected_if":["auth-required","unknown"],"how_to_check":"Find your Adobe Connect server version (Windows). Per APSB26-191, 12.12 and earlier are affected. You are fixed only on the patched build for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a. Adobe lists Windows only. It does not say whether the hosted service is affected.","fix":"Install the Adobe Connect patch for your branch (APSB26-191): 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a. On-prem patch files are on Adobe's Connect on-premise patches page.","status":"open","published_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:29:08+00:00","updated_at":"2026-11-10T22:39:31+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:29:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Adobe Connect: XML external entity flaw lets low-privileged users read server files","impact":"medium","summary":"Adobe Connect parses XML in a way that lets an attacker pull in external entities, reading files and directories outside the intended scope. A low-privileged account is enough, and no user interaction is needed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive files on the server filesystem","analyst_note":"Find Adobe's advisory for Adobe Connect to confirm affected and fixed versions, and whether hosted or self-hosted deployments are affected.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run Adobe Connect, including self-hosted deployments, are exposed to file reads on the server. The sources do not state which versions or configurations are affected, so the unknown fields below remain unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4573,"output_tokens":432,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Adobe's advisory for Adobe Connect to confirm affected and fixed versions, and whether hosted or self-hosted deployments are affected.","search":"'-10':83B '-11':82B '-121890':17A,20A '-191':79B '-2026':16A,19A '-611':49B '12.12':39B '2':85B '2026':81B '7.7':51B 'access':125C,133C 'adob':1A,24B,35B,74B,92C 'adobe':21A 'adobe-connect':23B 'affect':95C 'apsb26':78B 'arbitrari':111C 'attack':119C 'auth':27B 'auth-requir':26B 'awar':89B 'chang':146C 'connect':2A,22A,25B,36B,93C 'could':108C,120C 'cve':15A,18A 'cvss':50B 'cwe':48B 'directori':64B,129C 'earlier':41B 'entiti':5A,46B,103C 'exploit':91B,121C,135C 'extern':4A,45B,102C 'file':14A,62B,112C,127C 'fix':75B 'flaw':6A,47B 'host':31B 'improp':98C 'intend':67B,132C 'interact':71B,143C 'issu':138C 'lead':109C 'let':7A 'log':54B 'logged-in':53B 'low':9A,57B,117C 'low-privileg':8A,56B,116C 'need':73B 'outsid':65B,130C 'prioriti':84B 'privileg':10A,58B,118C 'read':12A,61B,114C 'refer':104C 'requir':28B,141C 'restrict':99C 'scope':68B,134C,144C 'self':30B 'self-host':29B 'sensit':126C 'server':13A 'system':113C 'user':11A,59B,70B,142C 'vendor':32B 'vulner':106C,123C 'window':33B,38B 'xml':3A,44B,101C 'xxe':34B,105C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Adobe Connect, including self-hosted deployments, are exposed to file reads on the server. The sources do not state which versions or configurations are affected, so the unknown fields below remain unknown.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:39:31Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":3019},"products":{"at":"2026-11-10T22:39:31Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":3019}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","authrequired","high","selfhosted","vendor","windows","xxe"],"campaign_type":null,"search_a":"'-121890':17A,20A '-2026':16A,19A 'adob':1A 'adobe':21A 'connect':2A,22A 'cve':15A,18A 'entiti':5A 'extern':4A 'file':14A 'flaw':6A 'let':7A 'low':9A 'low-privileg':8A 'privileg':10A 'read':12A 'server':13A 'user':11A 'xml':3A","search_b":"'-10':83B '-11':82B '-191':79B '-611':49B '12.12':39B '2':85B '2026':81B '7.7':51B 'adob':24B,35B,74B 'adobe-connect':23B 'apsb26':78B 'auth':27B 'auth-requir':26B 'awar':89B 'connect':25B,36B 'cvss':50B 'cwe':48B 'directori':64B 'earlier':41B 'entiti':46B 'exploit':91B 'extern':45B 'file':62B 'fix':75B 'flaw':47B 'host':31B 'intend':67B 'interact':71B 'log':54B 'logged-in':53B 'low':57B 'low-privileg':56B 'need':73B 'outsid':65B 'prioriti':84B 'privileg':58B 'read':61B 'requir':28B 'scope':68B 'self':30B 'self-host':29B 'user':59B,70B 'vendor':32B 'window':33B,38B 'xml':44B 'xxe':34B","search_c":"'access':125C,133C 'adob':92C 'affect':95C 'arbitrari':111C 'attack':119C 'chang':146C 'connect':93C 'could':108C,120C 'directori':129C 'entiti':103C 'exploit':121C,135C 'extern':102C 'file':112C,127C 'improp':98C 'intend':132C 'interact':143C 'issu':138C 'lead':109C 'low':117C 'low-privileg':116C 'outsid':130C 'privileg':118C 'read':114C 'refer':104C 'requir':141C 'restrict':99C 'scope':134C,144C 'sensit':126C 'system':113C 'user':142C 'vulner':106C,123C 'xml':101C 'xxe':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121890","severity":null,"published_at":"2026-11-10T22:18:26+00:00","modified_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121890:3019","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:39:31+00:00","modified_at":"2026-11-10T22:39:31+00:00","first_seen_at":"2026-11-10T22:39:31+00:00","fetched_at":"2026-11-10T22:39:31+00:00","note":"APSB26-191 (Nov 10 2026) read: affected 12.12 and earlier on Windows, fixed builds per branch, no known exploitation, PoC not seen. Hosted vs on-prem not stated in the bulletin. who_affected and how_to_check left unverified. No check written: the version is not readable from a repo.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html","https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119653,"url":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","title":"Find on-premise patch files for Adobe Connect 9-12","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}