Skip to content
Threat Feed
Subscribe
high threat

Adobe Security Updates - November 2026

Roundup of Adobe security advisories published in November 2026.

CVE search metadata

CVE search record: CVE-2026-113579. Severity: critical. CVSS: 9.9. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-113580. Severity: critical. CVSS: 9.9. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-114371. Severity: critical. CVSS: 9.9. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-119017. Severity: critical. CVSS: 9.9. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121349. Severity: critical. CVSS: 9.6. KEV: no. Product: Connect. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121351. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121352. Severity: critical. CVSS: 10.0. KEV: no. Product: Connect. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121353. Severity: critical. CVSS: 10.0. KEV: no. Product: Connect. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121354. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121896. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121904. Severity: critical. CVSS: 9.6. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121908. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121356. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121889. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121906. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121355. Severity: critical. CVSS: 9.1. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-110091. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-113557. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121350. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121887. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121890. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121892. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121894. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121898. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-121902. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

CVE search record: CVE-2026-122102. KEV: no. Brief: Adobe Security Updates - November 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-11-adobe-security-updates/

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Sources
1 public source
Freshness
Revision 1Nov 11, 02:08 UTC
Vulnerabilities
26 CVEs

What's new

  • 1. added CVE-2026-121355 Nov 11, 05:59 via nvd
  • 2. added CVE-2026-121356 +2 Nov 11, 05:59 via nvd
  • 3. added CVE-2026-121896 +2 Nov 11, 05:59 via nvd
  • 4. added CVE-2026-121353, CVE-2026-121354 Nov 11, 02:08 via nvd, source

This roundup covers 26 Adobe security vulnerabilities. CVSS base scores range from 9.1 to 10.0. None are reported as actively exploited at the time of release. The issues affect Adobe Connect, Audition, Connect, Experience Manager, Premiere Pro.

Summary

CVEProductSeverityCVSSEPSSKEVSource
CVE-2026-113579Experience ManagerCritical9.9noNVD (authoritative)
CVE-2026-113580Experience ManagerCritical9.9noNVD (authoritative)
CVE-2026-114371Experience ManagerCritical9.9noNVD (authoritative)
CVE-2026-119017Experience ManagerCritical9.9noNVD (authoritative)
CVE-2026-121349ConnectCritical9.6noNVD (authoritative)
CVE-2026-121351ConnectCritical10.0noNVD (authoritative)
CVE-2026-121352ConnectCritical10.0noNVD (authoritative)
CVE-2026-121353ConnectCritical10.0noNVD (authoritative)
CVE-2026-121354ConnectCritical9.9noNVD (authoritative)
CVE-2026-121355ConnectCritical9.1noNVD (authoritative)
CVE-2026-121356ConnectCritical10.0noNVD (authoritative)
CVE-2026-121887ConnectnoNVD (authoritative)
CVE-2026-121889ConnectCritical10.0noNVD (authoritative)
CVE-2026-121892ConnectnoNVD (authoritative)
CVE-2026-121894ConnectnoNVD (authoritative)
CVE-2026-121896ConnectCritical9.9noNVD (authoritative)
CVE-2026-121898ConnectnoNVD (authoritative)
CVE-2026-121902ConnectnoNVD (authoritative)
CVE-2026-121904Adobe ConnectCritical9.6noNVD (authoritative)
CVE-2026-121906ConnectCritical9.9noNVD (authoritative)
CVE-2026-121908ConnectCritical9.9noNVD (authoritative)
CVE-2026-110091Premiere PronoNVD (authoritative)
CVE-2026-113557AuditionnoNVD (authoritative)
CVE-2026-121350ConnectnoNVD (authoritative)
CVE-2026-121890ConnectnoNVD (authoritative)
CVE-2026-122102Adobe ConnectnoNVD (authoritative)

CVE-2026-113579

Adobe Experience Manager is vulnerable to a code injection vulnerability that allows low-privileged attackers to execute arbitrary code without user interaction. The vulnerability has a CVSS v3.1 base score of 9.9, indicating high severity due to the potential for remote code execution and the lack of required interaction.

Affected products:

  • Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-113579

Related in this roundup: CVE-2026-113580, CVE-2026-114371, CVE-2026-119017.

CVE-2026-113580

Adobe Experience Manager is vulnerable to an improper control of generation of code, which may allow a low-privileged, unauthenticated attacker to achieve arbitrary code execution. The vulnerability does not require user interaction, and successful exploitation results in a scope change, allowing the attacker to execute code within the context of the current user session.

Affected products:

  • Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-113580

Related in this roundup: CVE-2026-113579, CVE-2026-114371, CVE-2026-119017.

CVE-2026-114371

Adobe Experience Manager is vulnerable to an incorrect authorization issue that allows a low-privileged, unauthenticated attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the system scope, making it a critical security risk for deployments of the platform.

Affected products:

  • Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-114371

Related in this roundup: CVE-2026-113579, CVE-2026-113580, CVE-2026-119017.

CVE-2026-119017

Adobe Experience Manager is vulnerable to an incorrect authorization issue that allows a low-privileged attacker to achieve arbitrary code execution without user interaction. The vulnerability results in a changed scope and carries a CVSS base score of 9.9.

Affected products:

  • Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-119017

Related in this roundup: CVE-2026-113579, CVE-2026-113580, CVE-2026-114371.

CVE-2026-121349

Adobe Connect is vulnerable to a path traversal vulnerability (CWE-22) which allows an unauthenticated or low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and can lead to session takeover or privilege escalation.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121349

Related in this roundup: CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121351

Adobe Connect is vulnerable to a path traversal vulnerability (CWE-22) allowing unauthorized arbitrary file system read access. The vulnerability does not require user interaction and impacts the integrity and confidentiality of the host system, evidenced by a CVSS v3.1 base score of 10.0.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121351

Related in this roundup: CVE-2026-121349, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121352

Adobe Connect is vulnerable to an incorrect authorization issue that allows for privilege escalation. The vulnerability does not require user interaction and can be exploited to gain unauthorized access to sensitive resources.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121352

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121353

Adobe Connect is vulnerable to CRLF injection, which could be leveraged to achieve remote code execution in the context of the current user. The vulnerability does not require user interaction, has a scope of change, and carries a maximum CVSS score of 10.0.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121353

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121354

Adobe Connect is vulnerable to a path traversal vulnerability that allows unauthenticated, remote attackers to read arbitrary files from the file system. The vulnerability exists due to improper limitation of a pathname to a restricted directory, allowing attackers to escape the intended access scope. This vulnerability is rated as critical with a CVSS v3.1 score of 9.9 and does not require user interaction to exploit.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121354

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121355

Adobe Connect is vulnerable to an incorrect authorization flaw allowing unauthenticated privilege escalation. The vulnerability does not require user interaction and can be exploited to gain unauthorized access to sensitive data or functionality.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121355

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121356

Adobe Connect is vulnerable to Server-Side Request Forgery (SSRF) which can lead to privilege escalation. The vulnerability is remotely exploitable without user interaction and involves a change in scope, as indicated by a CVSS v3.1 base score of 10.0.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121356

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121887

Adobe Connect is vulnerable to an XML External Entity (XXE) injection flaw that allows a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the application with a changed scope, carrying a CVSS base score of 9.9.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121887

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121889

Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability that allows for privilege escalation. The vulnerability does not require user interaction for exploitation and results in a change of security scope, warranting a CVSS base score of 10.0.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121889

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121892

Adobe Connect is vulnerable to an Improper Control of Generation of Code (Code Injection) flaw that allows a low-privileged, unauthenticated attacker to execute arbitrary code without user interaction. The vulnerability results in a change of scope and carries a critical severity rating.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121892

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121894

Adobe Connect is vulnerable to SQL injection, which allows a low-privileged attacker to execute arbitrary SQL commands. This flaw can be leveraged for elevated access or control over user sessions, and because it does not require user interaction and involves a scope change, it carries a high risk of arbitrary code execution.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121894

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121896

Adobe Connect is vulnerable to a SQL injection vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability, classified as CWE-89, results in a scope change and carries a high CVSS severity score.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121896

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121898

Adobe Connect is vulnerable to an SQL injection flaw that allows low-privileged attackers to achieve arbitrary code execution without user interaction. The vulnerability is categorized under improper neutralization of special elements used in an SQL command and carries a high CVSS base score, indicating a significant risk to the integrity and availability of the application environment.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121898

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121902

Adobe Connect contains a SQL injection vulnerability that can be leveraged by an unauthenticated attacker to execute arbitrary SQL commands, which may lead to arbitrary code execution on the underlying server without requiring user interaction.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121902

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121904

Adobe Connect is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious JavaScript into form fields. This script executes within the context of a victim's browser session, potentially leading to unauthorized account access or session hijacking.

Affected products:

  • Adobe Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121904

Related in this roundup: CVE-2026-122102.

CVE-2026-121906

Adobe Connect is vulnerable to a path traversal vulnerability (CWE-22) that allows unauthenticated, remote attackers to perform arbitrary file reads on the underlying filesystem, potentially exposing sensitive configuration or system files.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121906

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121908, CVE-2026-121350, CVE-2026-121890.

CVE-2026-121908

Adobe Connect is vulnerable to a SQL injection vulnerability that allows low-privileged attackers to execute arbitrary code without user interaction. The vulnerability, classified as improper neutralization of special elements in an SQL command, leads to a change in scope and impacts the current user's context.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121908

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121350, CVE-2026-121890.

CVE-2026-110091

Adobe Premiere Pro contains a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to bypass security features and obtain unauthorized write access to the application's environment. The vulnerability is exploitable without user interaction and involves a change in scope.

Affected products:

  • Premiere Pro

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-110091

CVE-2026-113557

Adobe Audition is vulnerable to an improper input validation flaw that allows for arbitrary code execution. The vulnerability is triggered when a user is convinced to open a specially crafted malicious file, leading to potential system compromise under the context of the current user.

Affected products:

  • Audition

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-113557

CVE-2026-121350

Adobe Connect contains an SQL injection vulnerability that allows a low-privileged attacker to disclose sensitive information from memory without requiring user interaction. The vulnerability has a CVSS v3.1 base score of 7.7 and involves a scope change, indicating potential impact beyond the vulnerable application context.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121350

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121890.

CVE-2026-121890

Adobe Connect is vulnerable to an XML External Entity (XXE) injection flaw, allowing an authenticated, low-privileged attacker to perform arbitrary file system reads. The vulnerability allows for unauthorized access to files and directories outside of the application's intended scope without requiring user interaction.

Affected products:

  • Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121890

Related in this roundup: CVE-2026-121349, CVE-2026-121351, CVE-2026-121352, CVE-2026-121353, CVE-2026-121354, CVE-2026-121355, CVE-2026-121356, CVE-2026-121887, CVE-2026-121889, CVE-2026-121892, CVE-2026-121894, CVE-2026-121896, CVE-2026-121898, CVE-2026-121902, CVE-2026-121906, CVE-2026-121908, CVE-2026-121350.

CVE-2026-122102

Adobe Connect is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability allowing low-privileged attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes, potentially leading to unauthorized session access or account compromise.

Affected products:

  • Adobe Connect

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-122102

Related in this roundup: CVE-2026-121904.