External risk intelligence

Adobe Connect Path Traversal Allows Arbitrary File Read.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-121354

Adobe Connect is a web-conferencing and collaboration platform designed to be accessed by remote users over the internet. As a server-side web application that facilitates external communication, it is commonly deployed as a public-facing service, making its web interface and associated endpoints routinely reachable from the internet.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Connect, a web-conferencing platform, is impacted by a critical vulnerability that could allow unauthorized access to sensitive files on the system. This issue, a type of path traversal, does not require user interaction to be exploited and could potentially expose information beyond the intended scope.

Allows unauthorized file access.
Matters due to broad remote access.
Confirm relevance and impact to business.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to an Adobe Connect server. This request targets a feature that handles file access. By manipulating the path within the request, the attacker can trick the server into reading files from arbitrary locations on the file system, potentially exposing sensitive information. The vulnerability can lead to widespread access to system files.

Requires authenticated access.
Triggers with a manipulated path request.
Results in arbitrary file system reads.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Connect could allow an attacker to read sensitive files and directories on the system, bypassing intended access controls. This could occur when an attacker accesses specific system endpoints, potentially exposing configuration files or other sensitive data.

Arbitrary file system read.
Exploited via network requests.
Exposure of sensitive system files.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsibility for addressing this critical vulnerability in Adobe Connect likely falls to the platform or infrastructure teams managing the service, in coordination with security and potentially vendor management teams if a managed service or third-party deployment is in place. The immediate first step is to confirm the presence and accessibility of Adobe Connect instances, assess their business criticality, identify the system owner, and then prioritize remediation actions based on potential exposure and impact.

Platform or infrastructure teams own remediation.
Verify Adobe Connect instance exposure and criticality.
Plan and coordinate vendor-supported patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a web-conferencing and collaboration software platform. Organizations use it to host virtual meetings, training sessions, and interactive webinars. Because it is designed to facilitate remote communication, the application often runs as a server-side web service that manages document sharing and user-accessible files during conferences.

How does the path traversal vulnerability work in CVE-2026-121354?

This vulnerability is classified as CWE-22, known as Improper Limitation of a Pathname to a Restricted Directory. It occurs when software fails to properly sanitize input paths. In this case, an attacker sends a specially crafted request that manipulates file paths, tricking the system into bypassing its security boundaries to read files or directories from the underlying server that should be off-limits.

What triggers this vulnerability in the server?

The issue is triggered when an attacker sends a manipulated network request to specific system endpoints that handle file access. It is important to note that the vulnerability does not require any human user interaction to occur; the server processes the malicious request automatically. Normal, legitimate use of the conferencing platform's standard file-sharing features without path manipulation does not trigger this flaw.

Do I need to worry if my Adobe Connect instance is internal?

Halo Surface Signal indicates that Adobe Connect is frequently deployed as a public-facing service to support remote collaboration, which increases the likelihood of external reachability. If your instance is truly isolated from the internet, your immediate risk profile is different. However, any system accessible via a network—even internally—could be reachable by unauthorized actors who have gained access to your local network environment.

When should I take action for CVE-2026-121354?

You should begin your response by identifying all Adobe Connect instances currently running in your environment and assessing their business criticality. Coordinate with your platform or infrastructure teams to determine if your specific version is affected. Once you have identified the system owners, prioritize the evaluation of vendor-provided patches or guidance to address the vulnerability as soon as they become available.

References

www.adobe.com/trust/security/products/connect/apsb26-191.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.