CVE-2026-121906: critical vulnerability in Adobe Connect
Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 1.1%
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Adobe · Adobe ConnectRelated CVEs — Adobe Connect
In the same product, most dangerous first.
CVE-2026-121349CRITICALAdobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.3%CVE-2026-121892CRITICALAdobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)EPSS 1.2%CVE-2026-121887CRITICALAdobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.2%CVE-2025-27203CRITICALAdobe Connect | Deserialization of Untrusted Data (CWE-502)EPSS 1.2%CVE-2026-121351CRITICALAdobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.2%CVE-2026-121354CRITICALAdobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.1%