CVE-2026-121356

CriticalCVSS 10.0/10Last modified Nov 12, 2026

Description

Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AdobeAdobe Connect<= 12.8
AdobeAdobe Connect<= 12.9
AdobeAdobe Connect<= 12.10
AdobeAdobe Connect<= 12.11
AdobeAdobe Connect<= 12.12

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-121366.4The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' sCVE-2026-1213679.6On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be siCVE-2026-1213688.6On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authenticatCVE-2026-1213695.3On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause sysCVE-2026-121376.1The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to RefleCVE-2026-1213708.6On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to aCVE-2026-1213717.5On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to reCVE-2026-1213735.3The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content atCVE-2026-1213749.4Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit ruCVE-2026-1213799.6The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before delCVE-2026-1213805.3The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retCVE-2026-1213827.5A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bi
CVE-2026-121356: Critical severity, CVSS 10.0 | Vulnix