---
id: "CVE-2026-121900"
page: "https://infrastack.ai/live/CVE-2026-121900"
kind: "vulnerability"
aliases: ["CVE-2026-121900"]
title: "Adobe Connect: SQL injection lets low-privileged users run arbitrary code"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Connect", "fixed": ["12.12.a", "12.11.i", "12.10.f", "12.9.a", "12.8.a"], "affected": "<= 12.12 (Windows)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-connect", "other", "self-hosted", "sql-injection", "windows"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-11-10T22:18:27+00:00"
first_seen_at: "2026-11-10T22:27:27+00:00"
updated_at: "2026-11-10T22:39:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121900", "first_seen_at": "2026-11-10T22:27:27+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/connect/apsb26-191.html", "first_seen_at": "2026-11-10T22:39:13+00:00", "cites": ["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}]
exploit_sources: []
---

# Adobe Connect: SQL injection lets low-privileged users run arbitrary code

Link for people: https://infrastack.ai/live/CVE-2026-121900 (this .md is for agents)

Adobe Connect has a SQL injection (CWE-89, CVSS 8.3) that a low-privileged authenticated user can use to run arbitrary SQL, which Adobe says can lead to arbitrary code execution as the current user, with no user interaction. Fixed in APSB26-191 (Nov 10 2026). Adobe is not aware of exploitation in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Connect affected <= 12.12 (Windows) fixed 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a

## How to check

In Adobe Connect admin/About, read the installed version. You are exposed if it is 12.12 or earlier (on Windows) and lacks the matching patch letter: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a.

## Fix

Install the Adobe Connect update from APSB26-191: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, matching your current release line.

## Timeline

- 2026-11-10T22:27:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121900
- 2026-11-10T22:39:13+00:00 analyst https://www.adobe.com/trust/security/products/connect/apsb26-191.html — Read Adobe APSB26-191 (Nov 10 2026): affected 12.12 and earlier (Windows), fixed 12.12.a/12.11.i/12.10.f/12.9.a/12.8.a. No exploitation known per Adobe; no PoC searched. Social search skipped (new CVE).

## Documents

- [advisory] APSB26-191 Security update available for Adobe Connect https://www.adobe.com/trust/security/products/connect/apsb26-191.html

## From the sources

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_