Adobe Connect: Server-side request forgery enabling privilege escalation
Summary
Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-121356) that can lead to privilege escalation. No user interaction is required, and the CVSS base score is 10.0 (Critical). Adobe's CVE record shows that the flaw affects Windows installations of Adobe Connect up to version 12.12, and that an attacker with network access may be able to abuse the server to reach resources it should not access and to escalate privileges.
Affected
- Adobe Connect 0 through 12.8 (per CVE record)
- Adobe Connect 0 through 12.9 (per CVE record)
- Adobe Connect 0 through 12.10 (per CVE record)
- Adobe Connect 0 through 12.11 (per CVE record)
- Adobe Connect 0 through 12.12 (per CVE record)
- Platform per Adobe bulletin APSB26-191: Windows
Fixed in
- Adobe Connect 12.8.a
- Adobe Connect 12.9.a
- Adobe Connect 12.10.f
- Adobe Connect 12.11.i
- Adobe Connect 12.12.a
- Source: CVE record entries; the fixed build for this CVE should be confirmed in bulletin APSB26-191 before patching.
Workaround
Unknown. No vendor-documented workaround was found for this CVE. Until a fix is applied, restrict external access to the Adobe Connect server to what is needed.
Exploitation
- Adobe reports it is not aware of any exploits in the wild for the issues in bulletin APSB26-191.
- No public proof of concept was found in our research. Exploit databases were not checked directly, so this does not confirm that none exists.
- Attack prerequisites per CVSS: network access, low complexity, no privileges, no user interaction.
Our recommendation
- Identify all Adobe Connect servers and clients, including their exact build versions.
- Patch internet-facing Connect servers first and verify the installed version afterwards.
- Confirm the fixed build for CVE-2026-121356 in bulletin APSB26-191 at the Adobe Trust Center.
- Restrict external access to Connect servers until patched.
- Recheck NVD once it has analyzed the CVE, as its status is currently Received.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- CVE Record CVE-2026-121356 www.cve.org
- ZDI: November 2026 Security Update Review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:22.
Original description (NVD)
Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.