Adobe dropped 24 CVEs in Adobe Connect on November 10. Eighteen are Critical. Six are CVSS 10.0.

Every one of the six 10.0s shares the same vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Network-reachable, no authentication, no user interaction, scope changed. No precondition an attacker has to work around.

Two are confirmed by their own CVE records: CVE-2026-121356 and CVE-2026-121889, both SSRF.

The other four sit across path traversal, XXE, code injection, and SQL injection — six different flaw classes landing on the same score. That's not a cluster. That's a codebase where input validation was inconsistent, and a researcher (edra, credited for 15 of the 24) found every place it wasn't enforced.

The build table is the real problem

Adobe provides five fixed builds, one per branch:

Branch Fixed build
12.12 12.12.a
12.11 12.11.i
12.10 12.10.f
12.9 12.9.a
12.8 12.8.a

A server on 12.12 with no suffix is still vulnerable. A patch scanner that compares integers (>= 12.12) will show green. The suffix is the version.

This matters if you're writing detection logic, compliance checks, or SIEM rules against installed software versions. String comparison on the full version — including the alphabetic suffix — is the only correct check.

What the flaw mix looks like for a developer

  • 7 SQL injection (CWE-89) — parametrized queries or ORM not used consistently
  • 4 path traversal (CWE-22) — file path inputs not canonicalized before use
  • 2 SSRF (CWE-918) — outbound URL inputs not validated against an allowlist
  • 2 XXE (CWE-611) — XML parser configured with external entity resolution enabled
  • 1 code injection — user input reaching an eval or similar execution context
  • 1 CRLF injection — HTTP header construction from unescaped input
  • 3 incorrect authorization (CWE-863) — privilege checks missing or bypassable
  • 4 XSS — output encoding not applied consistently

None of these is an exotic class. All of them are in the OWASP Top 10. The finding is that a mature, shipping product hadn't applied consistent defenses across its own surface.

No known exploitation — for now

Adobe states it's not aware of exploits in the wild, and nothing is in CISA KEV as of November 11. That's accurate as of today.

A 10.0 SSRF with no auth requirement is a short research project to weaponize. Seven SQL injections on an internet-facing meeting server are automatable with off-the-shelf tooling. "Not aware of exploitation" is a timestamp.

Full breakdown

Priority order, hunt queries, and mitigation checklist:

👉 https://threataft.com/articles/adobe-connect-apsb26-191-mass-disclosure-24-cves