Adobe Connect: SQL injection allows arbitrary code execution
Summary
Adobe Connect contains an SQL injection vulnerability (CVE-2026-121894, CVSS 9.9, critical). An attacker with a low-privileged account can execute arbitrary SQL commands without user interaction, which can lead to arbitrary code execution in the context of the current user and to elevated access or control over the victim's account or session. The scope is changed, so the impact can extend beyond the vulnerable component. Adobe is not aware of any exploits in the wild for the issues in bulletin APSB26-191.
Affected
- Adobe Connect 0 to 12.12 (per the official CVE record, Windows per APSB26-191)
Fixed in
- Adobe Connect 12.12.a
- Adobe Connect 12.11.i
- Adobe Connect 12.10.f
- Adobe Connect 12.9.a
- Adobe Connect 12.8.a
Workaround
Unknown. No CVE-specific workaround has been published.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-191.
- An aggregator lists this CVE as not known to be exploited, but notes that its evidence is thin.
- No public proof of concept found.
Our recommendation
- Update Adobe Connect to the fixed build for your release line as a priority.
- Verify the fixed build against APSB26-191 before rollout.
- Until patched, do not expose Connect to the internet; limit access to trusted networks or VPN.
- Restrict who can register for or sign in to Connect accounts.
- Review logs for unusual database errors or query activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-121894 www.cve.org
- Adobe Security Bulletin APSB26-191 www.adobe.com
- Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
- OffSeq Radar: CVE-2026-121894 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:25.
Original description (NVD)
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.