{"id":"CVE-2026-121887","published":"2026-11-10T22:18:26.060","lastModified":"2026-11-11T05:19:30.710","description":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains an XXE vulnerability (CWE-611) in its XML parsing logic that allows a low-privileged attacker to trigger external entity resolution, potentially leading to arbitrary code execution in the context of the current user. The vulnerability is exploitable remotely without user interaction and has a changed scope, indicating broader impact than initially assumed.","exploitability":"Exploitation requires only low privileges and network access; no user interaction is needed, making it highly exploitable for authenticated attackers.","blast_radius":"Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability loss for the affected Adobe Connect instance and potentially downstream systems depending on deployment architecture.","remediation":"Upgrade to Adobe Connect version 2.590 or later, which contains a fix for CVE-2026-121887.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xxe","rce","webapp","low-priv","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:46:55.668Z"}}