{"id":"CVE-2026-121898","kind":"vulnerability","aliases":["CVE-2026-121898"],"related":[],"title":"Adobe Connect: SQL injection lets a low-privileged user run code","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe's APSB26-191 (Nov 10, 2026) fixes a critical SQL injection in Adobe Connect (CVE-2026-121898, CVSS 9.9). Adobe's vector is network, low privileges, no user interaction, scope changed; impact is arbitrary code execution. Adobe says it is not aware of exploits in the wild.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","self-hosted","sql-injection","vendor","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Find your self-hosted Adobe Connect server version (Windows). Affected per Adobe: 12.12 and earlier. Fixed builds: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. If you are below the fixed build for your branch, you are exposed. Adobe lists no fix for versions older than 12.8.","fix":"Install the Adobe Connect patch for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows), from Adobe's on-prem patch page.","status":"open","published_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:31+00:00","updated_at":"2026-11-10T22:32:34+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: SQL injection lets a low-privileged user run code","impact":"high","summary":"Adobe Connect has an SQL injection flaw that lets an attacker with a low-privilege account execute arbitrary code. The sources say no user interaction is needed and the scope is changed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs in the context of the application user","analyst_note":"Find the affected version ranges and Adobe's security bulletin for CVE-2026-121898; the NVD entry gives no products, versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Connect servers themselves are the likely exposure, since the flaw is in the server-side SQL handling. The sources do not name affected versions or configurations, so unknown. Teams using only hosted Adobe services may be unaffected, but the sources do not say.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4581,"output_tokens":439,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected version ranges and Adobe's security bulletin for CVE-2026-121898; the NVD entry gives no products, versions or fix.","search":"'-121898':15A,18A,49B '-191':35B '-2026':14A,17A,48B '10':37B '2026':38B '9.9':51B 'adob':1A,22B,32B,45B,52B,69B,80C 'adobe':19A 'adobe-connect':21B 'affect':83C 'apsb26':34B 'arbitrari':66B,103C,124C 'attack':117C 'awar':74B 'chang':63B,137C 'code':12A,67B,104C,125C 'command':95C 'connect':2A,20A,23B,46B,81C 'context':108C 'could':100C,118C 'critic':41B 'current':111C 'cve':13A,16A,47B 'cvss':50B 'element':90C 'execut':68B,105C,123C 'exploit':76B,119C,126C 'fix':39B 'host':26B 'impact':64B 'improp':86C 'inject':4A,29B,43B,97C 'interact':61B,134C 'issu':129C 'let':5A 'low':8A,57B,115C 'low-privileg':7A,114C 'network':56B 'neutral':87C 'nov':36B 'privileg':9A,58B,116C 'requir':132C 'result':101C 'run':11A 'say':70B 'scope':62B,135C 'self':25B 'self-host':24B 'special':89C 'sql':3A,28B,42B,94C,96C 'sql-inject':27B 'use':91C 'user':10A,60B,112C,133C 'vector':54B 'vendor':30B 'vulner':98C,121C 'wild':79B 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Adobe Connect server on Windows, version 12.12 or earlier, are exposed per Adobe's APSB26-191. Exploitation needs a low-privileged account but no user interaction, and Adobe rates scope as changed. Adobe's bulletin lists Windows only and does not say whether Adobe-hosted Connect needed action, so hosted customers should check Adobe's notice.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2991},"products":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2991},"who_affected":{"at":"2026-11-10T22:32:34Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2991}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","selfhosted","sqlinjection","vendor","windows"],"campaign_type":null,"search_a":"'-121898':15A,18A '-2026':14A,17A 'adob':1A 'adobe':19A 'code':12A 'connect':2A,20A 'cve':13A,16A 'inject':4A 'let':5A 'low':8A 'low-privileg':7A 'privileg':9A 'run':11A 'sql':3A 'user':10A","search_b":"'-121898':49B '-191':35B '-2026':48B '10':37B '2026':38B '9.9':51B 'adob':22B,32B,45B,52B,69B 'adobe-connect':21B 'apsb26':34B 'arbitrari':66B 'awar':74B 'chang':63B 'code':67B 'connect':23B,46B 'critic':41B 'cve':47B 'cvss':50B 'execut':68B 'exploit':76B 'fix':39B 'host':26B 'impact':64B 'inject':29B,43B 'interact':61B 'low':57B 'network':56B 'nov':36B 'privileg':58B 'say':70B 'scope':62B 'self':25B 'self-host':24B 'sql':28B,42B 'sql-inject':27B 'user':60B 'vector':54B 'vendor':30B 'wild':79B 'window':31B","search_c":"'adob':80C 'affect':83C 'arbitrari':103C,124C 'attack':117C 'chang':137C 'code':104C,125C 'command':95C 'connect':81C 'context':108C 'could':100C,118C 'current':111C 'element':90C 'execut':105C,123C 'exploit':119C,126C 'improp':86C 'inject':97C 'interact':134C 'issu':129C 'low':115C 'low-privileg':114C 'neutral':87C 'privileg':116C 'requir':132C 'result':101C 'scope':135C 'special':89C 'sql':94C,96C 'use':91C 'user':112C,133C 'vulner':98C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121898","severity":null,"published_at":"2026-11-10T22:18:26+00:00","modified_at":"2026-11-10T22:18:26+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121898:2991","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:32:34+00:00","modified_at":"2026-11-10T22:32:34+00:00","first_seen_at":"2026-11-10T22:32:34+00:00","fetched_at":"2026-11-10T22:32:34+00:00","note":"Read Adobe APSB26-191 (Nov 10 2026): this CVE is SQLi (CWE-89), CVSS 9.9, AV:N/PR:L/UI:N/S:C, arbitrary code execution; Connect 12.12 and earlier, Windows; not exploited per Adobe. Patch page doc linked as fix; I did not re-read it this run. No social search; sibling CVEs share the bulletin.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html","https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119653,"url":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","title":"Find on-premise patch files for Adobe Connect 9-12","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}