{"id":"CVE-2026-121894","published":"2026-11-10T22:18:26.650","lastModified":"2026-11-11T05:19:31.170","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of user-supplied input in SQL commands. A low-privileged attacker can exploit this without user interaction to execute arbitrary SQL, potentially escalating privileges or compromising data integrity and confidentiality.","exploitability":"Exploitation requires only low-privileged network access and no user interaction; the vulnerability is trivially exploitable given knowledge of the vulnerable endpoint and input vector.","blast_radius":"Successful exploitation could enable full compromise of the application’s database, leading to unauthorized data exfiltration, privilege escalation, or remote code execution depending on database permissions and backend configuration.","remediation":"Upgrade to Adobe Connect version 2.590 or later, which contains the vendor-provided fix for this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","privilege-escalation","web-app","low-priv-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:47:15.435Z"}}