ADOBE CONNECT · CVE-2026-121906 · Vendor
FIX → 12.12.a +4 ✓ verified
Adobe bulletin APSB26-191 (Nov 10, 2026) lists CVE-2026-121906 as a critical path traversal (CWE-22), CVSS 9.9, network-reachable, low privileges required, no user interaction, scope changed. Adobe lists the impact as arbitrary code execution; the NVD text says arbitrary file system read. Adobe is not aware of exploits in the wild.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Adobe Connect 12.12 or earlier on Windows servers. The attacker needs a low-privilege account (PR:L) but no user interaction, and can reach the server over the network. Adobe's bulletin does not say whether Adobe-hosted Connect is affected; teams on a hosted service should ask Adobe. Teams without a self-run Connect server can skip it.
Not affected if managed-hosting
Who cares adobe-connect, path-traversal, self-hosted, windows
Upgrade to 12.12.a +4
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.