External risk intelligence

Adobe Connect Code Injection Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-121892

Adobe Connect is a web-conferencing and collaboration platform designed to be accessed over the network, frequently serving as a public-facing or externally accessible service for remote meetings, webinars, and training sessions.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Connect has a critical vulnerability that could allow an attacker to run their own code on a user's machine without any interaction from the user. This issue affects the Adobe Connect platform, which is often used for external meetings and training. The main concern is to determine if this technology is in use and if so, understand the potential exposure.

Attackers can run code remotely.
It affects external collaboration services.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit this vulnerability by sending a specially crafted request to Adobe Connect. This could lead to arbitrary code execution within the context of the current user, without requiring any interaction from the user.

Network access required.
Vulnerable Adobe Connect component.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Connect could allow a low-privileged attacker to execute arbitrary code on a user's system without requiring interaction. This could affect the confidentiality, integrity, and availability of the user's environment.

Arbitrary code execution on user systems.
Exploited via network access with low privileges.
Potential for significant system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Adobe Connect, a web-conferencing platform, presents a critical code injection risk that could allow a low-privileged attacker to execute arbitrary code within the user's context. This vulnerability requires immediate attention from teams managing this collaboration service, prioritizing the identification and assessment of all deployed instances. Initial efforts should focus on confirming network exposure, assessing business criticality, and identifying the accountable owner to develop a targeted remediation plan.

Application owners should prioritize this issue.
Verify network exposure and business criticality first.
Plan vendor coordination and risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a software platform used for hosting web-based meetings, online training sessions, and virtual classrooms. It allows users to collaborate in real-time, share presentations, and conduct large-scale webinars over the network, acting as a centralized service for professional communication.

What does the code injection vulnerability in CVE-2026-121892 mean?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It means the software fails to properly filter input, allowing an attacker to insert and execute their own unauthorized commands. Successfully leveraging this flaw gives the attacker the ability to run arbitrary code with the permissions of the current user.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the Adobe Connect platform over the network. Crucially, the attack does not require any interaction from the user, meaning the malicious code executes automatically once the request is received by the vulnerable component.

Why should I care about this Adobe Connect vulnerability?

Because Adobe Connect is typically deployed as a public-facing service to facilitate remote meetings and webinars, Halo Surface Signal identifies it as highly likely to be exposed to the internet. This accessibility increases the risk that an attacker can reach the vulnerable service from outside your organization's network.

What should I do if I use Adobe Connect?

Start by identifying all instances of Adobe Connect deployed within your environment. Once mapped, confirm their network accessibility and assess their business criticality. Engage the owners of these systems to verify the deployment status and prepare for the necessary security updates provided by the vendor.

References

www.adobe.com/trust/security/products/connect/apsb26-191.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.