Adobe Connect: Path traversal enables arbitrary file system read
Summary
Adobe Connect contains a path traversal vulnerability (CWE-22) that allows reading arbitrary files on the file system. According to the CVE record, an attacker can access sensitive files and directories outside the intended scope. The attack is possible over the network without user interaction, but the attacker needs a low-privileged Connect account. The CVSS base score is 9.9 (critical) because the scope is changed and confidentiality, integrity and availability are all rated high.
Affected
- Adobe Connect 12.12 and earlier (Windows, according to bulletin APSB26-191)
- CNA record: affected branches 0 to 12.8, 12.9, 12.10, 12.11 and 12.12, with unaffected versions 12.8.a, 12.9.a, 12.10.f, 12.11.i and 12.12.a
- Other platforms: Unknown.
Fixed in
- Adobe Connect 12.8.a
- Adobe Connect 12.9.a
- Adobe Connect 12.10.f
- Adobe Connect 12.11.i
- Adobe Connect 12.12.a
Workaround
Unknown. No mitigation specific to this CVE has been published. As generic guidance, restrict access to Adobe Connect to trusted users and networks until the update is installed.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in bulletin APSB26-191.
- A third-party tracker records this CVE as not known to be exploited and rates the available evidence as thin.
- Public proof of concept: Unknown.
Our recommendation
- Patch Adobe Connect servers and clients to the fixed version for your branch (12.12.a or the matching fixed build) as soon as possible.
- Inventory all Connect servers and desktop clients, including mobile apps, and check which versions are in use.
- Until patched, limit access to trusted networks and review which accounts have access.
- Check server logs for unusual file access and monitor for further advisories from Adobe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-121354 www.cve.org
- Adobe Security Bulletin APSB26-191 www.adobe.com
- Offseq threat record CVE-2026-121354 radar.offseq.com
- ZDI November 2026 security update review www.zerodayinitiative.com
- Strix CVE-2026-121354 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:27.
Original description (NVD)
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.