CVE-2026-121892 PUBLISHED

Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)

Assigner: adobe
Reserved: 04.11.2026 Published: 10.11.2026 Updated: 11.11.2026

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor Adobe
Product Adobe Connect
Versions Default: unaffected
  • affected from 0 to 12.8 (incl.)
  • Version 12.8.a is unaffected
Vendor Adobe
Product Adobe Connect
Versions Default: unaffected
  • affected from 0 to 12.9 (incl.)
  • Version 12.9.a is unaffected
Vendor Adobe
Product Adobe Connect
Versions Default: unaffected
  • affected from 0 to 12.10 (incl.)
  • Version 12.10.f is unaffected
Vendor Adobe
Product Adobe Connect
Versions Default: unaffected
  • affected from 0 to 12.11 (incl.)
  • Version 12.11.i is unaffected
Vendor Adobe
Product Adobe Connect
Versions Default: unaffected
  • affected from 0 to 12.12 (incl.)
  • Version 12.12.a is unaffected

References

Problem Types

  • Improper Control of Generation of Code ('Code Injection') (CWE-94) CWE