CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Adobe Connect (on-premises, Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation

cve · CVE-2026-121889 single-source

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Adobe Connect on Windows: five unauthenticated CVSS 10.0 flaws fixed in 12.12.a and earlier; no known…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
1
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-121889, newest first. Check the date before acting on an older one.

  • Update every Adobe Connect server on Windows to the fixed build of its train (12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a), those reachable from the internet first, because five flaws need no privileges and no user interaction and Adobe names no mitigation.
    2026-11-11CVE-2026-121356 +6

Defender insights

What each entry about CVE-2026-121889 tells a defender to do, newest first.

2026-11-11NOTABLEAdobe Connect on Windows: five unauthenticated CVSS 10.0 flaws fixed in 12.12.a and earlier; no known exploitation

Exposure · detection

Story timeline

  1. 2026-11-11Adobe Connect (Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation
    trending-vulnerabilitiesAdobe Connect on Windows: five unauthenticated CVSS 10.0 flaws fixed in 12.12.a and earlier; no known exploitation

Hunting pivots

Affected products
Adobe Connect
Tags
auth-bypasspatch-availablepath-traversalpre-authsqlivulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-11/adobe-connect-apsb26-191-five-unauthenticated-cvss-10-rows · ATT&CK page ↗

Entries about Adobe Connect (on-premises, Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation (1)

2026-11-11 · view entry permalink →

NOTABLECVE-2026-121356 +6NATOA2

Adobe Connect (Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation

Adobe's priority 2 bulletin APSB26-191, published on 2026-11-10, fixes 24 CVEs in Adobe Connect on Windows 12.12 and earlier (Adobe, 2026-11-10). Five of them are scored CVSS 3.1 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C, so an attacker needs no account and no user interaction: two server-side request forgeries (CVE-2026-121356, CVE-2026-121889), a path traversal (CVE-2026-121351), an incorrect-authorization flaw (CVE-2026-121352) and a CRLF injection (CVE-2026-121353); Adobe describes the impact of all five as privilege escalation (Adobe, 2026-11-10). Two more rows need no privileges either: an SQL injection leading to code execution (CVE-2026-121902, 9.4) and an incorrect-authorization flaw (CVE-2026-121355, 9.1), and a further group of authenticated rows is fixed in the same release (Adobe, 2026-11-10). The fixed builds are 12.12.a, 12.11.i, 12.10.f, 12.9.a and 12.8.a (Adobe, 2026-11-10). The bulletin gives no root-cause detail, names no workaround, and Adobe says it is not aware of exploitation.

Adobe has released a priority 2 security update for Adobe Connect.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Adobe
vulnerability11 Nov 03:38Zsingle-sourceOpen finding →
Sources: Adobe (security bulletin APSB26-191)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • adobe.com1 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (1)