External risk intelligence

Adobe Connect SQL Injection Leading to Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-121908

Adobe Connect is a web conferencing and remote meeting platform designed to be accessed over the network, often deployed as an internet-facing web application to facilitate remote collaboration and external communication, making it a common target for network-based access.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Adobe Connect, a web conferencing platform, and could allow a user with limited privileges to execute arbitrary code on the system. The issue is a type of SQL injection that can be exploited remotely without any user interaction, and it changes the scope of the vulnerability's impact.

A code execution flaw exists in Adobe Connect.
It allows a low-privileged attacker remote code execution.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

A low-privileged attacker could exploit this vulnerability by sending specially crafted input to Adobe Connect. This input would be processed in a way that allows the attacker to execute arbitrary SQL commands, potentially leading to the execution of arbitrary code on the system. This attack can be performed remotely and does not require any interaction from a user.

Network access and low privileges required.
Specially crafted input to SQL commands.
Arbitrary code execution in user context.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a low-privileged attacker to execute arbitrary code on a system running Adobe Connect, when the application is accessible over a network and its scope is changed.

Arbitrary code execution in the current user's context.
Exploitation by a low-privileged attacker over the network.
Compromise of the user's system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems owners and application owners are likely responsible for addressing this SQL injection vulnerability in Adobe Connect, as it impacts a web conferencing platform accessible over the network. The first practical step is to identify all instances of Adobe Connect, determine their reachability and business criticality, locate the accountable owner, and then prioritize remediation efforts based on risk.

Application owners should manage remediation.
Verify affected Adobe Connect instances.
Plan risk-based remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Connect?

Adobe Connect is a software platform used for web conferencing, online meetings, and virtual classrooms. Because it facilitates remote collaboration, organizations typically host it as a web application accessible over a network to support both internal teams and external participants joining from various locations.

What does SQL injection mean for CVE-2026-121908?

This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection (CWE-89). It means the software does not properly filter data provided by a user, allowing an attacker to inject unauthorized database queries. In this specific case, that flaw goes further, enabling the attacker to execute arbitrary code on the underlying system.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted inputs to the Adobe Connect application over a network. The vulnerability does not require the attacker to have administrative rights—low-privileged access is sufficient—and it does not require any interaction from other users to succeed.

Why is this CVE considered relevant for my organization?

Halo Surface Signal notes that Adobe Connect is frequently deployed as an internet-facing application to support external communication. This increases its visibility and accessibility to potential threats, making it critical to determine if your specific instances are reachable over the network.

How should I respond to this threat advisory?

Your first step is to perform an inventory of all systems running Adobe Connect to understand where the software is deployed. Once identified, evaluate the accessibility and business criticality of each instance, then coordinate with the system owners to prioritize and apply the necessary security updates provided by the vendor.

References

www.adobe.com/trust/security/products/connect/apsb26-191.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.