{"id":"CVE-2026-121906","kind":"vulnerability","aliases":["CVE-2026-121906"],"related":[],"title":"Adobe Connect 12.12 and earlier on Windows: path traversal by a logged-in user, rated able to run code","description":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe bulletin APSB26-191 (Nov 10, 2026) lists CVE-2026-121906 as a critical path traversal (CWE-22), CVSS 9.9, network-reachable, low privileges required, no user interaction, scope changed. Adobe lists the impact as arbitrary code execution; the NVD text says arbitrary file system read. Adobe is not aware of exploits in the wild.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","path-traversal","self-hosted","vendor","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your Adobe Connect server version (Administration console / About). Adobe lists Connect 12.12 and earlier on Windows as affected. You are patched only if you run 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a, the build for your release line.","fix":"Install the APSB26-191 update for your release line: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (Windows). Priority 2.","status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","triaged_at":"2026-11-10T22:28:31+00:00","updated_at":"2026-11-10T22:29:26+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Connect: path traversal lets attackers read arbitrary server files","impact":"high","summary":"Adobe Connect has a path traversal flaw that lets an attacker read files and directories outside the intended access scope. No user interaction is needed, and the scope is changed, so the impact reaches beyond the vulnerable component.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive server files and directories outside scope","analyst_note":"Check Adobe's security bulletin for CVE-2026-121906 for affected and fixed versions, whether auth is required, and whether self-hosted only.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Connect servers, including self-hosted deployments, are the ones exposed. The sources do not state which versions are affected or whether hosted Adobe-managed instances are included. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000675,"input_tokens":4579,"output_tokens":434,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for CVE-2026-121906 for affected and fixed versions, whether auth is required, and whether self-hosted only.","search":"'-121906':23A,26A,50B '-191':43B '-2026':22A,25A,49B '-22':57B '10':45B '12.12':3A '2026':46B '9.9':59B 'abl':17A 'access':129C,137C 'adob':1A,30B,40B,71B,87B,96C 'adobe':27A 'adobe-connect':29B 'affect':99C 'apsb26':42B 'arbitrari':76B,83B,118C 'attack':123C 'awar':90B 'bulletin':41B 'chang':70B,150C 'code':20A,77B 'connect':2A,28A,31B,97C 'could':115C,124C 'critic':53B 'cve':21A,24A,48B 'cvss':58B 'cwe':56B 'directori':110C,133C 'earlier':5A 'execut':78B 'exploit':92B,125C,139C 'file':84B,119C,131C 'host':37B 'impact':74B 'improp':102C 'intend':136C 'interact':68B,147C 'issu':142C 'lead':116C 'limit':103C 'list':47B,72B 'log':13A 'logged-in':12A 'low':63B 'network':61B 'network-reach':60B 'nov':44B 'nvd':80B 'outsid':134C 'path':8A,33B,54B,111C 'path-travers':32B 'pathnam':106C 'privileg':64B 'rate':16A 'reachabl':62B 'read':86B,121C 'requir':65B,145C 'restrict':109C 'run':19A 'say':82B 'scope':69B,138C,148C 'self':36B 'self-host':35B 'sensit':130C 'system':85B,120C 'text':81B 'travers':9A,34B,55B,112C 'user':15A,67B,146C 'vendor':38B 'vulner':113C,127C 'wild':95B 'window':7A,39B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Adobe Connect 12.12 or earlier on Windows servers. The attacker needs a low-privilege account (PR:L) but no user interaction, and can reach the server over the network. Adobe's bulletin does not say whether Adobe-hosted Connect is affected; teams on a hosted service should ask Adobe. Teams without a self-run Connect server can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:29:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2986},"products":{"at":"2026-11-10T22:29:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2986},"how_to_check":{"at":"2026-11-10T22:29:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":2986}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","critical","pathtraversal","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-121906':23A,26A '-2026':22A,25A '12.12':3A 'abl':17A 'adob':1A 'adobe':27A 'code':20A 'connect':2A,28A 'cve':21A,24A 'earlier':5A 'log':13A 'logged-in':12A 'path':8A 'rate':16A 'run':19A 'travers':9A 'user':15A 'window':7A","search_b":"'-121906':50B '-191':43B '-2026':49B '-22':57B '10':45B '2026':46B '9.9':59B 'adob':30B,40B,71B,87B 'adobe-connect':29B 'apsb26':42B 'arbitrari':76B,83B 'awar':90B 'bulletin':41B 'chang':70B 'code':77B 'connect':31B 'critic':53B 'cve':48B 'cvss':58B 'cwe':56B 'execut':78B 'exploit':92B 'file':84B 'host':37B 'impact':74B 'interact':68B 'list':47B,72B 'low':63B 'network':61B 'network-reach':60B 'nov':44B 'nvd':80B 'path':33B,54B 'path-travers':32B 'privileg':64B 'reachabl':62B 'read':86B 'requir':65B 'say':82B 'scope':69B 'self':36B 'self-host':35B 'system':85B 'text':81B 'travers':34B,55B 'user':67B 'vendor':38B 'wild':95B 'window':39B","search_c":"'access':129C,137C 'adob':96C 'affect':99C 'arbitrari':118C 'attack':123C 'chang':150C 'connect':97C 'could':115C,124C 'directori':110C,133C 'exploit':125C,139C 'file':119C,131C 'improp':102C 'intend':136C 'interact':147C 'issu':142C 'lead':116C 'limit':103C 'outsid':134C 'path':111C 'pathnam':106C 'read':121C 'requir':145C 'restrict':109C 'scope':138C,148C 'sensit':130C 'system':120C 'travers':112C 'user':146C 'vulner':113C,127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121906","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:27+00:00","fetched_at":"2026-11-10T22:27:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121906:2986","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:29:26+00:00","modified_at":"2026-11-10T22:29:26+00:00","first_seen_at":"2026-11-10T22:29:26+00:00","fetched_at":"2026-11-10T22:29:26+00:00","note":"Read Adobe APSB26-191: affected 12.12 and earlier on Windows, fixed builds listed, PR:L, no exploitation known. Adobe states impact as code execution, not only file read; retitled. Hosted status not stated. No PoC or discussion searched (fresh, no CVE-id chatter expected).","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}