External risk intelligence

Adobe Connect SQL Injection Vulnerability Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-121902

Adobe Connect is a web-based conferencing and collaboration platform designed to be accessed over the network, often serving as a public-facing portal for meetings, webinars, and training sessions, making its web interface naturally exposed to the internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical SQL injection vulnerability in Adobe Connect, a web conferencing platform. The issue allows attackers to run unauthorized commands, potentially impacting data confidentiality, integrity, and availability without needing user interaction. The main concern is confirming if our Adobe Connect instances are relevant and exposed to this threat.

Attackers can inject malicious commands into Adobe Connect.
It allows unauthorized command execution on the platform.
Confirm relevance and exposure of Adobe Connect instances.

Attack Path

How an attacker could exploit the issue

An attacker could target Adobe Connect by sending specially crafted data over the network to a vulnerable component. This could allow them to execute arbitrary SQL commands, potentially leading to code execution and compromise of the application's data and functionality.

No prior access needed to target.
SQL injection vulnerability triggered.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the Adobe Connect application. This could impact the confidentiality, integrity, and availability of the application's data and services.

Application data and service integrity.
By sending malicious SQL commands remotely.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Adobe Connect's SQL injection vulnerability requires immediate attention from teams responsible for application security and infrastructure. The first practical step is to locate all instances of Adobe Connect, determine their exposure and criticality, and identify the accountable owner for remediation planning.

Application owners and security teams should lead.
Verify external reachability and business criticality.
Plan remediation based on risk and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a web-based platform used by organizations to host virtual meetings, webinars, and interactive training sessions. Because it manages real-time collaboration and stores significant participant or organizational data, it functions as a centralized communication portal accessible over a network.

What does SQL injection mean for CVE-2026-121902?

This vulnerability, classified as CWE-89, means the software improperly processes data sent to its database. An attacker can manipulate this flaw to insert their own malicious commands, tricking the system into running unauthorized instructions instead of legitimate database queries.

How is this vulnerability triggered?

An attacker triggers the flaw by sending specially crafted, malicious data to the application over the network. Crucially, this does not require an attacker to have a pre-existing account or any interaction from legitimate users to succeed.

Why should I care if my instance is internet-facing?

Halo Surface Signal indicates that Adobe Connect is frequently used as a public-facing portal. If your instance is reachable from the internet, it is directly exposed to remote, unauthenticated attackers, making it a high priority for verification.

What is the first step to address this?

You should begin by performing an inventory to locate all active Adobe Connect instances within your environment. Once identified, confirm which ones are internet-facing and determine their business criticality to prioritize the implementation of official security updates.

References

www.adobe.com/trust/security/products/connect/apsb26-191.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.