{"id":"CVE-2026-121900","kind":"vulnerability","aliases":["CVE-2026-121900"],"related":[],"title":"Adobe Connect: SQL injection lets low-privileged users run arbitrary code","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction.","summary":"Adobe Connect has a SQL injection (CWE-89, CVSS 8.3) that a low-privileged authenticated user can use to run arbitrary SQL, which Adobe says can lead to arbitrary code execution as the current user, with no user interaction. Fixed in APSB26-191 (Nov 10 2026). Adobe is not aware of exploitation in the wild.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-connect","other","self-hosted","sql-injection","windows"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"In Adobe Connect admin/About, read the installed version. You are exposed if it is 12.12 or earlier (on Windows) and lacks the matching patch letter: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a.","fix":"Install the Adobe Connect update from APSB26-191: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, matching your current release line.","status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:29:01+00:00","updated_at":"2026-11-10T22:39:13+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T22:29:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: SQL injection lets low-privileged users run arbitrary code","impact":"high","summary":"Adobe Connect has an SQL injection flaw that lets a low-privileged account run arbitrary SQL commands. The sources say this could lead to arbitrary code execution in the context of the current user, with no user interaction needed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary SQL and possibly code as the service user","analyst_note":"Find affected Adobe Connect versions and Adobe's fixed release in the Adobe security bulletin; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121900 did not give them.","how_to_check":"- unknown","plain_action":"","product_name":"Adobe Connect","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Connect servers and allow low-privileged user accounts. The sources do not list affected versions or configurations.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4577,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Adobe Connect versions and Adobe's fixed release in the Adobe security bulletin; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121900 did not give them.","search":"'-121900':15A,18A '-191':75B '-2026':14A,17A '-89':39B '10':77B '2026':78B '8.3':41B 'adob':1A,22B,32B,56B,79B,88C 'adobe':19A 'adobe-connect':21B 'affect':91C 'apsb26':74B 'arbitrari':11A,53B,61B,111C,132C 'attack':125C 'authent':47B 'awar':82B 'code':12A,62B,112C 'command':103C,134C 'connect':2A,20A,23B,33B,89C 'context':116C 'could':108C,126C 'current':66B,119C 'cve':13A,16A 'cvss':40B 'cwe':38B 'element':98C 'execut':63B,113C,131C 'exploit':84B,127C,135C 'fix':72B 'host':27B 'improp':94C 'inject':4A,30B,37B,105C 'interact':71B,143C 'issu':138C 'lead':59B 'let':5A 'low':7A,45B,123C 'low-privileg':6A,44B,122C 'neutral':95C 'nov':76B 'privileg':8A,46B,124C 'requir':141C 'result':109C 'run':10A,52B 'say':57B 'self':26B 'self-host':25B 'special':97C 'sql':3A,29B,36B,54B,102C,104C,133C 'sql-inject':28B 'use':50B,99C 'user':9A,48B,67B,70B,120C,142C 'vulner':106C,129C 'wild':87B 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Adobe Connect servers and allow low-privileged user accounts. The sources do not list affected versions or configurations.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:39:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3018},"products":{"at":"2026-11-10T22:39:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3018},"how_to_check":{"at":"2026-11-10T22:39:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3018},"who_affected":{"at":"2026-11-10T22:39:13Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3018}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","high","other","selfhosted","sqlinjection","vendor","windows"],"campaign_type":null,"search_a":"'-121900':15A,18A '-2026':14A,17A 'adob':1A 'adobe':19A 'arbitrari':11A 'code':12A 'connect':2A,20A 'cve':13A,16A 'inject':4A 'let':5A 'low':7A 'low-privileg':6A 'privileg':8A 'run':10A 'sql':3A 'user':9A","search_b":"'-191':75B '-89':39B '10':77B '2026':78B '8.3':41B 'adob':22B,32B,56B,79B 'adobe-connect':21B 'apsb26':74B 'arbitrari':53B,61B 'authent':47B 'awar':82B 'code':62B 'connect':23B,33B 'current':66B 'cvss':40B 'cwe':38B 'execut':63B 'exploit':84B 'fix':72B 'host':27B 'inject':30B,37B 'interact':71B 'lead':59B 'low':45B 'low-privileg':44B 'nov':76B 'privileg':46B 'run':52B 'say':57B 'self':26B 'self-host':25B 'sql':29B,36B,54B 'sql-inject':28B 'use':50B 'user':48B,67B,70B 'wild':87B 'window':31B","search_c":"'adob':88C 'affect':91C 'arbitrari':111C,132C 'attack':125C 'code':112C 'command':103C,134C 'connect':89C 'context':116C 'could':108C,126C 'current':119C 'element':98C 'execut':113C,131C 'exploit':127C,135C 'improp':94C 'inject':105C 'interact':143C 'issu':138C 'low':123C 'low-privileg':122C 'neutral':95C 'privileg':124C 'requir':141C 'result':109C 'special':97C 'sql':102C,104C,133C 'use':99C 'user':120C,142C 'vulner':106C,129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121900","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121900:3018","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:39:13+00:00","modified_at":"2026-11-10T22:39:13+00:00","first_seen_at":"2026-11-10T22:39:13+00:00","fetched_at":"2026-11-10T22:39:13+00:00","note":"Read Adobe APSB26-191 (Nov 10 2026): affected 12.12 and earlier (Windows), fixed 12.12.a/12.11.i/12.10.f/12.9.a/12.8.a. No exploitation known per Adobe; no PoC searched. Social search skipped (new CVE).","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}