External risk intelligence

Adobe Connect SQL Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-121894

Adobe Connect is a web conferencing and virtual classroom platform designed to be accessible over the internet for remote participants and external users. Because it serves as a public-facing web service for meetings and collaboration, its components are commonly deployed with internet connectivity, making this web-based SQL injection vulnerability likely to be reachable in real-world configurations.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Connect, a web conferencing platform, has a critical vulnerability that allows unauthorized execution of SQL commands. This could lead to elevated access or control over a user's account or session.

A flaw lets attackers run dangerous commands.
It affects internet-accessible collaboration tools.
Confirm if our Adobe Connect is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could begin by interacting with Adobe Connect over a network. After gaining low privileges, they could target the application's handling of SQL commands. This could allow the attacker to run their own SQL commands, potentially leading to elevated access or control over a user's account or session.

Network access required.
Exploits SQL command handling.
Leads to elevated access or control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Connect could allow a low-privileged attacker to execute arbitrary SQL commands. When successful, an attacker could potentially gain elevated access or control over a victim's account or session, impacting the confidentiality, integrity, and availability of the affected system.

User account and session data.
Through network requests to the service.
Unauthorized account access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Adobe Connect requires prompt action from the platform or application owners responsible for this web conferencing tool. The initial focus should be on identifying all Adobe Connect instances, assessing their exposure to external access, and determining business criticality to prioritize remediation efforts. Coordination with the vendor or internal security teams will be crucial for a timely and effective resolution.

Platform or application owners should lead remediation.
Verify external reachability and business criticality.
Plan coordinated patching or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a web conferencing and virtual classroom platform. Organizations use it to host online meetings, webinars, and collaborative virtual training sessions that require remote participants to connect via the internet.

What does SQL injection mean for CVE-2026-121894?

This vulnerability, classified as CWE-89, occurs when the software improperly handles data within database queries. Because the application fails to neutralize special elements, an attacker can inject their own SQL commands, allowing them to manipulate the database or execute arbitrary code in the context of the current user session.

How does an attacker trigger this vulnerability?

An attacker initiates the attack by sending crafted network requests to the Adobe Connect service. The flaw requires the attacker to have at least low-privileged access to the system. It is not triggered by typical user interactions like joining a meeting; rather, it requires intentional manipulation of the application's underlying database command handling.

Is my Adobe Connect instance at risk?

If your Adobe Connect instance is reachable over the internet, Halo Surface Signal identifies this as a likely target. Because the platform is designed for broad external access for remote collaboration, it is often exposed to network-based threats, making it important to confirm if your specific implementation is accessible from outside your local network.

How should I respond to this threat?

Begin by identifying all running instances of Adobe Connect within your environment. Once mapped, assess their external accessibility and determine which systems house critical business data. Coordinate closely with your internal security team or the vendor to plan and apply the necessary security updates to mitigate the risk of unauthorized access.

References

www.adobe.com/trust/security/products/connect/apsb26-191.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.