{"id":"CVE-2026-121913","kind":"vulnerability","aliases":["CVE-2026-121913"],"related":[],"title":"Adobe Connect: incorrect authorization lets low-privileged users escalate privileges","description":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.","summary":"Adobe Connect has an incorrect authorization flaw that lets a low-privileged account gain elevated access to sensitive information or functionality. Exploitation needs no user interaction.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Connect","fixed":["12.12.a","12.11.i","12.10.f","12.9.a","12.8.a"],"affected":"<= 12.12 (Windows), below 12.12.a / 12.11.i / 12.10.f / 12.9.a / 12.8.a","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-connect","self-hosted","vendor","windows"],"not_affected_if":["patched-build"],"how_to_check":"In Adobe Connect admin, check the installed version (Windows server). Exposed if it is 12.12 or earlier and below the patched build for its branch (12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a).","fix":"Update Adobe Connect on Windows to the patched build for your branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a (APSB26-191).","status":"open","published_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:28:49+00:00","updated_at":"2026-11-10T22:39:15+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Adobe Connect: incorrect authorization lets low-privileged users escalate privileges","impact":"high","summary":"Adobe Connect has an incorrect authorization flaw that lets a low-privileged account gain elevated access to sensitive information or functionality. Exploitation needs no user interaction.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged account reaches sensitive data or admin functions","analyst_note":"Check Adobe's security bulletin for affected and fixed Adobe Connect versions and the vendor's own mitigation for CVE-2026-121913.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations that run Adobe Connect and let low-privileged users sign in. The sources do not name affected versions, so unknown whether a given deployment is in range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4542,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected and fixed Adobe Connect versions and the vendor's own mitigation for CVE-2026-121913.","search":"'-121913':14A,17A '-2026':13A,16A 'access':44B,82C 'account':41B 'adob':1A,21B,28B,55C 'adobe':18A 'adobe-connect':20B 'affect':58C 'attack':74C 'author':4A,33B,62C 'connect':2A,19A,22B,29B,56C 'could':65C,75C 'cve':12A,15A 'elev':43B,81C 'escal':10A,69C 'exploit':50B,76C,88C 'flaw':34B 'function':49B,87C 'gain':42B,80C 'host':25B 'incorrect':3A,32B,61C 'inform':47B,85C 'interact':54B,96C 'issu':91C 'let':5A,36B 'low':7A,39B,72C 'low-privileg':6A,38B,71C 'need':51B 'privileg':8A,11A,40B,68C,73C 'requir':94C 'result':66C 'self':24B 'self-host':23B 'sensit':46B,84C 'user':9A,53B,95C 'vendor':26B 'vulner':63C,78C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Organisations running self-hosted Adobe Connect on Windows, version 12.12 or earlier. An attacker needs a low-privileged account on the server and no user interaction, over the network. Adobe-hosted Connect and non-Windows installs are not listed in the bulletin; Adobe does not say whether they are affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:39:15Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3017},"products":{"at":"2026-11-10T22:39:15Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3017},"how_to_check":{"at":"2026-11-10T22:39:15Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3017},"who_affected":{"at":"2026-11-10T22:39:15Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","run_id":3017}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeconnect","connect"],"ptokens":["adobe","connect"],"labels":["adobeconnect","high","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-121913':14A,17A '-2026':13A,16A 'adob':1A 'adobe':18A 'author':4A 'connect':2A,19A 'cve':12A,15A 'escal':10A 'incorrect':3A 'let':5A 'low':7A 'low-privileg':6A 'privileg':8A,11A 'user':9A","search_b":"'access':44B 'account':41B 'adob':21B,28B 'adobe-connect':20B 'author':33B 'connect':22B,29B 'elev':43B 'exploit':50B 'flaw':34B 'function':49B 'gain':42B 'host':25B 'incorrect':32B 'inform':47B 'interact':54B 'let':36B 'low':39B 'low-privileg':38B 'need':51B 'privileg':40B 'self':24B 'self-host':23B 'sensit':46B 'user':53B 'vendor':26B 'window':27B","search_c":"'access':82C 'adob':55C 'affect':58C 'attack':74C 'author':62C 'connect':56C 'could':65C,75C 'elev':81C 'escal':69C 'exploit':76C,88C 'function':87C 'gain':80C 'incorrect':61C 'inform':85C 'interact':96C 'issu':91C 'low':72C 'low-privileg':71C 'privileg':68C,73C 'requir':94C 'result':66C 'sensit':84C 'user':95C 'vulner':63C,78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121913","severity":null,"published_at":"2026-11-10T22:18:27+00:00","modified_at":"2026-11-10T22:18:27+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121913:3017","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","severity":null,"published_at":"2026-11-10T22:39:15+00:00","modified_at":"2026-11-10T22:39:15+00:00","first_seen_at":"2026-11-10T22:39:15+00:00","fetched_at":"2026-11-10T22:39:15+00:00","note":"Read Adobe APSB26-191 (Nov 10 2026): CVE listed High 8.8, Windows only, no known exploits. No vendor workaround stated.","cites":["https://www.adobe.com/trust/security/products/connect/apsb26-191.html"]}],"documents":[{"id":119650,"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","title":"APSB26-191 Security update available for Adobe Connect","kind":"advisory","source":"analyst","publisher":null,"text":"Adobe priority 2 update, Nov 10 2026. Affected: Adobe Connect 12.12 and earlier, Windows. Updated versions: 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a. CVE-2026-121354: Path Traversal CWE-22, impact listed by Adobe: arbitrary code execution, critical, CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C. Credit: edra. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}