A low-privileged attacker can exploit the flaw over a network to execute arbitrary code in the context of the current user.The vulnerability requires no additional user interaction. Adobe assigns a CVSS 3.1 score of 9.9 Critical and addresses it in Adobe Connect updates released on November 10, 2026.
What it allows
How Can CVE-2026-121896 Affect Adobe Connect?
The flaw is an SQL injection in Adobe Connect. It occurs when special elements in externally influenced input are not adequately neutralized before use in an SQL command.
Adobe's CVSS vector shows a network attack with low complexity. Exploitation requires low privileges, but no action from another user.
Successful exploitation can execute arbitrary code with the current user's authority. The vector records high confidentiality, integrity, and availability impacts, with changed scope.
Adobe said it was unaware of exploits in the wild when it published APSB26-191. The CVE was not in CISA's Known Exploited Vulnerabilities catalog version 2026.11.10.
Who is affected
Which Adobe Connect Versions Are Affected by CVE-2026-121896?
Adobe lists Adobe Connect 12.12 and earlier on Windows as affected. The bulletin does not identify another platform as affected.
Adobe provides fixed releases for five maintained branches: 12.12.a, 12.11.i, 12.10.f, 12.9.a, and 12.8.a. Administrators should select the fixed release that matches their supported branch.
The bulletin gives the update a priority rating of 2. Adobe recommends updating each installation to the newest applicable version.
Timeline
- 2026-11-10
Adobe published bulletin APSB26-191 with fixed Adobe Connect releases and said it was unaware of exploitation in the wild.
- 2026-11-10
NVD published the CVE record with Adobe's CVSS 3.1 score of 9.9 Critical.
What to do
-
Install the fixed Adobe Connect release
Update each affected Windows installation to 12.12.a, 12.11.i, 12.10.f, 12.9.a, or 12.8.a, as applicable. Confirm the running version after maintenance.
-
Inventory Adobe Connect servers
Identify every Windows deployment running Adobe Connect 12.12 or earlier. Prioritize systems reachable from untrusted networks or used by many privileged accounts.
-
Review low-privileged account access
Brandefense recommends checking low-privileged accounts for unnecessary access and unexplained changes. The Adobe record says low privileges are sufficient for exploitation.
-
Investigate suspicious server activity
Brandefense recommends reviewing application, database, and host telemetry for unusual queries, unexpected processes, or privilege changes. Preserve evidence when activity warrants investigation.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-121896?
It is a critical SQL injection vulnerability in Adobe Connect. A low-privileged network attacker may exploit it to execute arbitrary code without additional user interaction.
Which Adobe Connect versions are affected by CVE-2026-121896?
Adobe lists Adobe Connect 12.12 and earlier on Windows as affected. The bulletin does not list another affected platform.
Which versions fix CVE-2026-121896?
Adobe lists 12.12.a, 12.11.i, 12.10.f, 12.9.a, and 12.8.a as fixed releases for their respective maintained branches.
Is CVE-2026-121896 actively exploited?
Adobe said it was unaware of exploitation in the wild on November 10, 2026. The CVE was not in CISA KEV catalog version 2026.11.10.
What is the CVSS score for CVE-2026-121896?
Adobe assigns CVSS 3.1 9.9 Critical. The vector describes a low-complexity network attack requiring low privileges and no user interaction.
Sources
- Security Update Available for Adobe Connect | APSB26-191Adobe
- CVE-2026-121896 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
