{"id":"CVE-2026-121902","published":"2026-11-10T22:18:27.143","lastModified":"2026-11-11T05:19:31.767","description":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special characters in SQL commands, allowing unauthenticated remote attackers to execute arbitrary SQL queries without user interaction. This could lead to full data exfiltration, unauthorized modification, or service disruption.","exploitability":"Exploitation is straightforward for remote attackers as it requires no authentication, user interaction, or special conditions—only network access to the vulnerable Adobe Connect endpoint.","blast_radius":"Successful exploitation could result in complete compromise of backend database confidentiality and integrity, with potential denial of service due to database manipulation or resource exhaustion.","remediation":"Upgrade to Adobe Connect version 2.590 or later, as this is the fixed version published by Adobe for CVE-2026-121902.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","rce","web","remote-exploit","no-user-interaction"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:56:25.326Z"}}