Adobe Connect (Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation
Adobe Connect on Windows: five unauthenticated CVSS 10.0 flaws fixed in 12.12.a and earlier; no known exploitation
Defender actions
- Update every Adobe Connect server on Windows to the fixed build of its train (12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a), those reachable from the internet first, because five flaws need no privileges and no user interaction and Adobe names no mitigation.
Analysis
Adobe's priority 2 bulletin APSB26-191, published on 2026-11-10, fixes 24 CVEs in Adobe Connect on Windows 12.12 and earlier (Adobe, 2026-11-10). Five of them are scored CVSS 3.1 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C, so an attacker needs no account and no user interaction: two server-side request forgeries (CVE-2026-121356, CVE-2026-121889), a path traversal (CVE-2026-121351), an incorrect-authorization flaw (CVE-2026-121352) and a CRLF injection (CVE-2026-121353); Adobe describes the impact of all five as privilege escalation (Adobe, 2026-11-10). Two more rows need no privileges either: an SQL injection leading to code execution (CVE-2026-121902, 9.4) and an incorrect-authorization flaw (CVE-2026-121355, 9.1), and a further group of authenticated rows is fixed in the same release (Adobe, 2026-11-10). The fixed builds are 12.12.a, 12.11.i, 12.10.f, 12.9.a and 12.8.a (Adobe, 2026-11-10). The bulletin gives no root-cause detail, names no workaround, and Adobe says it is not aware of exploitation.
Cited evidence
Adobe has released a priority 2 security update for Adobe Connect.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.