Adobe Connect: Path traversal allowing arbitrary code execution
Summary
A path traversal flaw (CWE-22) in Adobe Connect, a web conferencing and e-learning platform, can be exploited remotely without user interaction. An attacker with a low-privilege account can reach files outside the intended directory and gain elevated access or control over the victim's account or session, with possible impact beyond the Connect component (scope changed). The CVSS base score is 9.6 (Critical).
Affected
- Adobe Connect 12.12 and earlier according to bulletin APSB26-191 (Windows)
- The CNA record lists Adobe Connect 0 to 12.11 as affected
- Hosted and on-premise deployments are to be checked
Fixed in
- Adobe Connect 12.12.a (per APSB26-191 for the 12.12 line)
- Adobe Connect 12.11.i
- Adobe Connect 12.10.f
- Adobe Connect 12.9.a
- Adobe Connect 12.8.a
- Confirm the mapping of this CVE to these builds in APSB26-191 before recording it
Workaround
Unknown. No workaround is documented for this CVE.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-191.
- No public proof of concept was found at the time of research.
- Attack vector: network, no user interaction, low privileges required.
Our recommendation
- Identify all Adobe Connect instances, including hosted and on-premise ones, and check whether they are reachable from the internet.
- Install the fixed build from APSB26-191 as a priority, on-premise installations first.
- Review accounts with low privileges (registered, guest and meeting users) and remove unneeded ones.
- Restrict network access to the Connect server while patching.
- Monitor logs for unusual file access and account activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE Record CVE-2026-121349 www.cve.org
- Adobe Connect release notes helpx.adobe.com
- Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
- OffSeq Radar: CVE-2026-121349 radar.offseq.com
- Strix: CVE-2026-121349 (third party) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:33.
Original description (NVD)
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.