{"id":"CVE-2026-121896","kind":"vulnerability","aliases":["CVE-2026-121896"],"related":[],"title":"Adobe Connect on Windows: SQL injection by a low-privileged user can lead to code execution (fixed in APSB26-191)","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe's APSB26-191 (Nov 10, 2026) fixes a critical SQL injection in Adobe Connect (CVE-2026-121896, CVSS 9.9). Adobe's vector is network, low privileges, no user interaction, scope changed; impact is rated arbitrary code execution. Adobe says it is not aware of exploits in the wild.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-connect","self-hosted","sql-injection","vendor","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Find your Adobe Connect on-prem server version (Windows). Affected per Adobe: 12.12 and earlier. Fixed builds: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. If you are on a lower patch level than the fixed build for your branch, you are exposed.","fix":"Install the Adobe Connect patch for your branch (Windows): 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, from Adobe's on-prem patch page.","status":"open","published_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:33+00:00","updated_at":"2026-11-10T22:32:34+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: SQL injection lets a low-privileged user run code","impact":"high","summary":"Adobe Connect has an SQL injection flaw in which special characters in input are not neutralized before being used in a database query. A low-privileged attacker can exploit it without user interaction to execute arbitrary code in the context of the current user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary code runs as the current user on the server","analyst_note":"Confirm affected Adobe Connect versions and the Adobe security bulletin with the fixed release; the NVD entry lists no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"Adobe Connect","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000656,"input_tokens":4581,"output_tokens":395,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected Adobe Connect versions and the Adobe security bulletin with the fixed release; the NVD entry lists no product ranges.","search":"'-121896':24A,27A,58B '-191':21A,44B '-2026':23A,26A,57B '10':46B '2026':47B '9.9':60B 'adob':1A,31B,41B,54B,61B,79B,90C 'adobe':28A 'adobe-connect':30B 'affect':93C 'apsb26':20A,43B 'arbitrari':76B,113C,134C 'attack':127C 'awar':84B 'chang':72B,147C 'code':16A,77B,114C,135C 'command':105C 'connect':2A,29A,32B,55B,91C 'context':118C 'could':110C,128C 'critic':50B 'current':121C 'cve':22A,25A,56B 'cvss':59B 'element':100C 'execut':17A,78B,115C,133C 'exploit':86B,129C,136C 'fix':18A,48B 'host':35B 'impact':73B 'improp':96C 'inject':6A,38B,52B,107C 'interact':70B,144C 'issu':139C 'lead':14A 'low':10A,66B,125C 'low-privileg':9A,124C 'network':65B 'neutral':97C 'nov':45B 'privileg':11A,67B,126C 'rate':75B 'requir':142C 'result':111C 'say':80B 'scope':71B,145C 'self':34B 'self-host':33B 'special':99C 'sql':5A,37B,51B,104C,106C 'sql-inject':36B 'use':101C 'user':12A,69B,122C,143C 'vector':63B 'vendor':39B 'vulner':108C,131C 'wild':89B 'window':4A,40B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Adobe Connect server on Windows, version 12.12 or earlier, are exposed per Adobe's APSB26-191. An attacker needs a low-privileged account, no user interaction. Adobe's bulletin lists Windows only and does not say whether Adobe-hosted Connect needed action.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2992},"products":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2992},"who_affected":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2992}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","selfhosted","sqlinjection","vendor","windows"],"campaign_type":null,"search_a":"'-121896':24A,27A '-191':21A '-2026':23A,26A 'adob':1A 'adobe':28A 'apsb26':20A 'code':16A 'connect':2A,29A 'cve':22A,25A 'execut':17A 'fix':18A 'inject':6A 'lead':14A 'low':10A 'low-privileg':9A 'privileg':11A 'sql':5A 'user':12A 'window':4A","search_b":"'-121896':58B '-191':44B '-2026':57B '10':46B '2026':47B '9.9':60B 'adob':31B,41B,54B,61B,79B 'adobe-connect':30B 'apsb26':43B 'arbitrari':76B 'awar':84B 'chang':72B 'code':77B 'connect':32B,55B 'critic':50B 'cve':56B 'cvss':59B 'execut':78B 'exploit':86B 'fix':48B 'host':35B 'impact':73B 'inject':38B,52B 'interact':70B 'low':66B 'network':65B 'nov':45B 'privileg':67B 'rate':75B 'say':80B 'scope':71B 'self':34B 'self-host':33B 'sql':37B,51B 'sql-inject':36B 'user':69B 'vector':63B 'vendor':39B 'wild':89B 'window':40B","search_c":"'adob':90C 'affect':93C 'arbitrari':113C,134C 'attack':127C 'chang':147C 'code':114C,135C 'command':105C 'connect':91C 'context':118C 'could':110C,128C 'current':121C 'element':100C 'execut':115C,133C 'exploit':129C,136C 'improp':96C 'inject':107C 'interact':144C 'issu':139C 'low':125C 'low-privileg':124C 'neutral':97C 'privileg':126C 'requir':142C 'result':111C 'scope':145C 'special':99C 'sql':104C,106C 'use':101C 'user':122C,143C 'vulner':108C,131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121896","severity":null,"published_at":"2026-11-10T22:18:26+00:00","modified_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121896:2992","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:32:34+00:00","modified_at":"2026-11-10T22:32:34+00:00","first_seen_at":"2026-11-10T22:32:34+00:00","fetched_at":"2026-11-10T22:32:34+00:00","note":"Read Adobe APSB26-191: this CVE is SQLi, CVSS 9.9 (AV:N/PR:L/S:C), arbitrary code execution, Windows only, not exploited per Adobe. Same bulletin and fix as sibling Connect CVEs. No PoC or social search done.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html","https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119653,"url":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","title":"Find on-premise patch files for Adobe Connect 9-12","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}