Adobe Connect: SQL injection with information disclosure
Summary
Adobe Connect versions up to and including 12.12 are affected by an SQL injection vulnerability (CWE-89). An attacker with a low-privileged account on the network can exploit it without user interaction. The CVSS vector rates only the confidentiality impact as high, while the description refers to disclosure of sensitive memory. The exact impact should be confirmed in the Adobe advisory.
Affected
- Adobe Connect 0 to 12.8, 0 to 12.9, 0 to 12.10, 0 to 12.11 and 0 to 12.12 (Windows) per the CVE record
- Unaffected builds per the CVE record: 12.8.a, 12.9.a, 12.10.f, 12.11.i, 12.12.a for the respective branches
- Adobe advisory APSB26-191 lists 12.12 and earlier as affected
Fixed in
- Update to the build for your branch: 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a, or to the newest version
- Sources differ on the exact fixed build for this CVE. Confirm it in APSB26-191 before rollout.
Workaround
Unknown. No specific workaround was found for this CVE. Patching is the priority; restrict access to trusted users only if patching is not possible.
Exploitation
- Exploited in the wild: not known. Adobe and ZDI report no known exploits for APSB26-191.
- Public proof of concept: none found in the research, but this is not a complete check.
- NVD analysis was still pending at the time of research.
Our recommendation
- Check whether you run a self-hosted Adobe Connect server and whether it is reachable from the internet.
- If it is exposed and not on a current build, patch it in the next maintenance window. The bulletin is rated priority 2.
- Apply all other Connect fixes from APSB26-191 at the same time, since several are rated Critical.
- Adobe-hosted cloud instances are patched by Adobe; verify this with your provider.
- Monitor the Connect server logs for suspicious database errors or unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE Record CVE-2026-121350 (CVE Program) www.cve.org
- Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
- CVE-2026-121350 mirror (threatint) cve.threatint.com
- HKCERT Adobe Monthly Security Update November 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:43.
Original description (NVD)
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.