Adobe Connect APSB26-191: Five CVSS 10.0 Flaws Need No Login — SSRF, Path Traversal and Auth Bypass Among 24 Fixes for On-Prem Servers
Adobe's APSB26-191 fixes 24 Adobe Connect flaws, including five unauthenticated CVSS 10.0 bugs led by CVE-2026-121356, in versions 12.12 and earlier on Windows.
Adobe has released security bulletin APSB26-191 for Adobe Connect, its web conferencing and virtual classroom platform. The update fixes 24 vulnerabilities in the on-premises Windows server. Five of them carry the highest possible CVSS score of 10.0, and Adobe rates them reachable over the network with no login and no user interaction. Another eight score 9.9 and lead to arbitrary code execution for any attacker with a low-privileged account.
Adobe says it is not aware of any exploits in the wild and gives the update Priority 2. Even so, this is one of the densest critical bulletins of the year for a product that is often exposed to the internet so outside guests can join meetings.
What Happened
The bulletin was published on 10 November 2026, alongside Adobe's monthly update cycle. It covers Adobe Connect 12.12 and earlier on Windows. Fixed builds are available for every supported branch:
- 12.12.a
- 12.11.i
- 12.10.f
- 12.9.a
- 12.8.a
Of the 24 CVEs, 17 are rated Critical, five High and two Medium. Most of the findings are credited to a researcher known as "edra", who reported 15 of the flaws. Others are credited to Jim Green (green-jam), archyxsec and Diego (goedix).
Technical Details
The five CVSS 10.0 issues all share the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H. In plain terms, they can be attacked remotely, are easy to trigger, need no credentials, and the impact crosses a security boundary. Adobe lists the impact of all five as privilege escalation:
- CVE-2026-121356 – server-side request forgery (SSRF)
- CVE-2026-121889 – server-side request forgery (SSRF)
- CVE-2026-121351 – path traversal
- CVE-2026-121352 – incorrect authorization
- CVE-2026-121353 – CRLF injection
A sixth unauthenticated flaw, CVE-2026-121355 (incorrect authorization, CVSS 9.1), and an unauthenticated SQL injection, CVE-2026-121902 (CVSS 9.4, arbitrary code execution), widen the pre-login attack surface further.
The 9.9-rated group needs a low-privileged account but ends in arbitrary code execution, with the scope changed. That group includes path traversal (CVE-2026-121354, CVE-2026-121906), XML external entity processing (CVE-2026-121887), code injection (CVE-2026-121892) and four SQL injection bugs (CVE-2026-121894, -121896, -121898, -121908). On a platform where self-registered or guest-style accounts are common, "low privileges" can be a low bar.
The remaining fixes cover stored and reflected cross-site scripting, another XXE that allows arbitrary file reads (CVE-2026-121890), a SQL injection that exposes memory (CVE-2026-121350) and an additional authorization flaw (CVE-2026-121913).
Adobe has not published root-cause details, and no public proof-of-concept was known at the time of writing. However, SSRF and path traversal in a server application are classic stepping stones. They can let an attacker reach internal services, read configuration files or session material, and then escalate.
Who Is Affected
Organisations that run their own Adobe Connect server on Windows, at version 12.12 or earlier, are affected. Typical users include:
- Universities and training providers running virtual classrooms
- Government agencies and defence organisations that require self-hosted conferencing
- Enterprises using Connect for webinars and internal training
On-premises Connect servers are frequently internet-facing by design so external participants can join. That makes the unauthenticated bugs particularly relevant.
Patch Status
Fixed versions are available now for every supported release branch, listed above. Adobe points administrators to the Connect on-premises patch release notes for installation instructions. The bulletin lists no workarounds.
What To Do Now
- Identify every Connect server. Check version strings across production, staging and forgotten training instances.
- Patch to the fixed build for your branch (12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a), starting with internet-facing servers.
- Restrict exposure while you patch. If possible, put the admin interface behind a VPN or IP allow-list and limit which network paths the server can reach outbound. That reduces the value of the SSRF bugs.
- Review accounts. Remove stale, guest or self-registered accounts that are not needed, since eight of the critical bugs only require a low-privileged login.
- Check logs for anomalies. Look for unusual requests with encoded path sequences (
..%2f), unexpected outbound requests from the Connect server to internal addresses, and new administrator accounts. - Watch for follow-ups. Adobe updates bulletins if exploitation is detected, and critical Connect bugs tend to attract attention once patches can be diffed.
A quick way to check for suspicious traversal patterns in IIS logs on the Connect host (defensive search only):
Select-String -Path "C:\inetpub\logs\LogFiles\*\*.log" -Pattern "\.\.%2f|\.\.%5c|%0d%0a" | Select-Object -First 50Why It Matters
Collaboration platforms sit at a sensitive junction. They are reachable from the internet, integrated with directory services, and they hold recordings, chat logs and attendee data. Five maximum-severity, pre-authentication flaws in a single product release is a strong signal to move Connect patching to the top of this week's list. Do not wait for the usual monthly window.
The absence of known exploitation is good news, but it is a snapshot. Attackers routinely reverse-engineer patches for self-hosted enterprise software within days, so the safest assumption is that the gap between "no known exploits" and "actively exploited" will be short.
