{"id":"CVE-2026-121353","published":"2026-11-10T22:18:25.217","lastModified":"2026-11-11T05:19:29.943","description":"Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-93"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains a CRLF injection vulnerability (CWE-93) that allows unauthenticated attackers to inject carriage return and line feed characters into HTTP responses, potentially enabling session fixation, header injection, or UI redressing attacks that could lead to account takeover or arbitrary code execution in the user's context. The vulnerability has a changed scope, indicating broader impact than initially assumed.","exploitability":"Exploitation requires no user interaction and can be performed remotely by an unauthenticated attacker due to the CVSS vector (AV:N/AC:L/PR:N/UI:N).","blast_radius":"Successful exploitation could allow attackers to hijack user sessions, inject malicious content into responses, or escalate privileges, potentially compromising multiple users and gaining unauthorized access to sensitive meeting data or administrative functions.","remediation":"Upgrade to Adobe Connect version 2.590 or later, which includes a fix for this vulnerability.","detection":"Defenders should monitor web server access logs for HTTP requests containing unencoded CRLF sequences (%0d%0a or %0a) in query parameters, headers, or form fields—especially those targeting meeting join URLs, login endpoints, or API routes—and correlate with anomalous response headers such as duplicate Set-Cookie entries or unexpected Location headers. No reliable host-based indicators are expected.","tags":["crlf-injection","header-injection","web-app","session-hijack","no-user-interaction"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:44:54.847Z"}}