Adobe Connect: Incorrect Authorization allows privilege escalation
Summary
Adobe Connect contains an Incorrect Authorization vulnerability (CWE-863) that allows privilege escalation. An attacker with a low-privileged account can obtain elevated access to sensitive information or functionality. No user interaction is required. Adobe rates the issue as high (CVSS 8.8) and includes it in its Priority 2 update APSB26-191.
Affected
- Adobe Connect 0 to 12.8 (fixed in 12.8.a)
- Adobe Connect 0 to 12.9 (fixed in 12.9.a)
- Adobe Connect 0 to 12.10 (fixed in 12.10.f)
- Adobe Connect 0 to 12.11 (fixed in 12.11.i)
- Adobe Connect 0 to 12.12 (fixed in 12.12.a)
- Platform per Adobe bulletin: Windows
- Ranges taken from the CVE record; verify on APSB26-191.
Fixed in
- Adobe Connect 12.8.a, 12.9.a, 12.10.f, 12.11.i or 12.12.a, depending on your release branch (per CVE record and Adobe bulletin update table)
- Confirm on APSB26-191 that this CVE is listed.
Workaround
Unknown. No vendor-issued workaround identified.
- Until patched, restrict access to Connect servers and review accounts.
Exploitation
- Adobe is not aware of any exploits in the wild for issues in this update.
- No public proof-of-concept found in our searches.
- CISA KEV status not checked.
Our recommendation
- Update Adobe Connect to the fixed release for your branch as a priority.
- Until patched, limit internet exposure and remove unneeded low-privilege or guest accounts.
- Review logs for unexpected role or permission changes.
- Check exposure via your asset inventory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-191 www.adobe.com
- Strix CVE page CVE-2026-121913 www.strix.ai
- OffSeq CVE page CVE-2026-121913 radar.offseq.com
- Zero Day Initiative November 2026 security update review www.zerodayinitiative.com
- Adobe Security Bulletin APSB26-150 helpx.adobe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:41.
Original description (NVD)
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.