{"id":"CVE-2026-121892","published":"2026-11-10T22:18:26.520","lastModified":"2026-11-11T05:19:31.020","description":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in their own context without user interaction, due to improper control over code generation. The vulnerability has a changed scope, indicating it affects components beyond the immediate attack surface.","exploitability":"Exploitation requires only low privileges and no user interaction, making it highly exploitable by authenticated attackers with minimal access.","blast_radius":"Successful exploitation could lead to full compromise of the affected system including confidentiality, integrity, and availability impacts within the current user context, potentially enabling lateral movement or persistent access.","remediation":"Upgrade to Adobe Connect version 2.590 or later, as this is the fixed version specified in the advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","rce","webapp","low-priv"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:47:04.681Z"}}