{"id":"CVE-2026-121902","kind":"vulnerability","aliases":["CVE-2026-121902"],"related":[],"title":"Adobe Connect: unauthenticated SQL injection can lead to code execution (patched in APSB26-191)","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction.","summary":"Adobe's APSB26-191 (Nov 10, 2026) fixes a critical SQL injection in Adobe Connect (CVE-2026-121902, CVSS 9.4). Adobe's vector is network, no privileges, no user interaction; impact is rated arbitrary code execution. Adobe says it is not aware of exploits in the wild. Part of a 24-CVE bulletin for Connect.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","self-hosted","sql-injection","unauthenticated","vendor","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Find your Adobe Connect on-prem server version (Windows). Affected: 12.12 and earlier. Fixed builds per Adobe: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. If you run a branch/patch level lower than the fixed build for your branch (e.g. 12.11.h or older), you are exposed. Adobe lists no fix for versions older than 12.8.","fix":"Install the Adobe Connect patch for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows). Patches for licensed on-prem customers are on Adobe's on-prem patch page; per Adobe 12.11.i goes on top of 12.11.h.","status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:46+00:00","updated_at":"2026-11-10T22:30:31+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: SQL injection flaw lets attackers run arbitrary code","impact":"high","summary":"Adobe Connect has an SQL injection flaw that lets an attacker run arbitrary SQL commands on the application's database. The sources say this could lead to arbitrary code execution and loss of confidentiality, integrity and availability, and no user interaction is needed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL and possibly code on the server","analyst_note":"Find the affected Adobe Connect versions, the fixed release and the required preconditions in Adobe's security bulletin for this CVE.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run a self-hosted Adobe Connect server are exposed. Sources do not list affected versions or whether the flaw needs a specific configuration or account. Hosted Adobe Connect customers should check the vendor's notice.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00069,"input_tokens":4590,"output_tokens":462,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Adobe Connect versions, the fixed release and the required preconditions in Adobe's security bulletin for this CVE.","search":"'-121902':17A,20A,52B '-191':14A,38B '-2026':16A,19A,51B '10':40B '2026':41B '24':85B '9.4':54B 'adob':1A,24B,35B,48B,55B,71B,90C 'adobe':21A 'adobe-connect':23B 'affect':93C 'applic':136C 'apsb26':13A,37B 'arbitrari':68B,113C,124C 'attack':117C 'avail':133C 'awar':76B 'bulletin':87B 'code':9A,69B,114C 'command':105C,126C 'compromis':128C 'confidenti':130C 'connect':2A,22A,25B,49B,89B,91C 'could':110C,118C 'critic':44B 'cve':15A,18A,50B,86B 'cvss':53B 'element':100C 'execut':10A,70B,115C,123C 'exploit':78B,119C,137C 'fix':42B 'host':28B 'impact':65B 'improp':96C 'inject':5A,31B,46B,107C 'integr':131C 'interact':64B,145C 'issu':140C 'lead':7A 'network':59B 'neutral':97C 'nov':39B 'part':82B 'patch':11A 'potenti':127C 'privileg':61B 'rate':67B 'requir':143C 'result':111C 'say':72B 'self':27B 'self-host':26B 'special':99C 'sql':4A,30B,45B,104C,106C,125C 'sql-inject':29B 'unauthent':3A,32B 'use':101C 'user':63B,144C 'vector':57B 'vendor':33B 'vulner':108C,121C 'wild':81B 'window':34B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted (licensed on-prem) Adobe Connect server on Windows, version 12.12 or earlier, are exposed per Adobe's APSB26-191. Adobe's CVSS vector rates it network-reachable with no authentication and no user interaction. Adobe's bulletin lists Windows only; it does not say whether Adobe-hosted Connect needed action, so hosted customers should check Adobe's notice.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:30:31Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2990},"products":{"at":"2026-11-10T22:30:31Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2990},"who_affected":{"at":"2026-11-10T22:30:31Z","by":"analyst","doc":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","run_id":2990}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","selfhosted","sqlinjection","unauthenticated","vendor","windows"],"campaign_type":null,"search_a":"'-121902':17A,20A '-191':14A '-2026':16A,19A 'adob':1A 'adobe':21A 'apsb26':13A 'code':9A 'connect':2A,22A 'cve':15A,18A 'execut':10A 'inject':5A 'lead':7A 'patch':11A 'sql':4A 'unauthent':3A","search_b":"'-121902':52B '-191':38B '-2026':51B '10':40B '2026':41B '24':85B '9.4':54B 'adob':24B,35B,48B,55B,71B 'adobe-connect':23B 'apsb26':37B 'arbitrari':68B 'awar':76B 'bulletin':87B 'code':69B 'connect':25B,49B,89B 'critic':44B 'cve':50B,86B 'cvss':53B 'execut':70B 'exploit':78B 'fix':42B 'host':28B 'impact':65B 'inject':31B,46B 'interact':64B 'network':59B 'nov':39B 'part':82B 'privileg':61B 'rate':67B 'say':72B 'self':27B 'self-host':26B 'sql':30B,45B 'sql-inject':29B 'unauthent':32B 'user':63B 'vector':57B 'vendor':33B 'wild':81B 'window':34B","search_c":"'adob':90C 'affect':93C 'applic':136C 'arbitrari':113C,124C 'attack':117C 'avail':133C 'code':114C 'command':105C,126C 'compromis':128C 'confidenti':130C 'connect':91C 'could':110C,118C 'element':100C 'execut':115C,123C 'exploit':119C,137C 'improp':96C 'inject':107C 'integr':131C 'interact':145C 'issu':140C 'neutral':97C 'potenti':127C 'requir':143C 'result':111C 'special':99C 'sql':104C,106C,125C 'use':101C 'user':144C 'vulner':108C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121902","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121902:2990","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:30:31+00:00","modified_at":"2026-11-10T22:30:31+00:00","first_seen_at":"2026-11-10T22:30:31+00:00","fetched_at":"2026-11-10T22:30:31+00:00","note":"Read Adobe APSB26-191 and the on-prem patch page. Not exploited per Adobe, ZDI. No PoC found; did not search social. Sibling Connect CVEs share the bulletin.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html","https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119653,"url":"https://helpx.adobe.com/adobe-connect/kb/connect-on-prem-patches.html","title":"Find on-premise patch files for Adobe Connect 9-12","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}