{"id":"CVE-2026-121356","published":"2026-11-10T22:18:25.637","lastModified":"2026-11-11T05:19:30.253","description":"Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate the application into making unintended internal or external HTTP requests, potentially leading to privilege escalation due to the changed scope.","exploitability":"Exploitation requires no user interaction or prior authentication and leverages network-accessible SSRF endpoints without additional constraints mentioned.","blast_radius":"Successful exploitation could enable attackers to access internal services, bypass network segmentation, and escalate privileges within the Adobe Connect environment.","remediation":"Upgrade to Adobe Connect version 2.590 or later, which contains the official fix for this SSRF vulnerability.","detection":"Defenders should monitor Adobe Connect access logs for anomalous outbound HTTP requests to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x), localhost (127.0.0.1), or metadata endpoints (e.g., 169.254.169.254); unexpected User-Agent strings or high-frequency requests to non-standard ports may also indicate exploitation attempts.","tags":["ssrf","privilege-escalation","web-app","no-user-interaction"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:45:08.247Z"}}