Adobe has patched a server-side request forgery flaw in Adobe Connect, tracked as CVE-2026-121356, that carries the maximum CVSS score of 10.0. The flaw is one of six perfect-score vulnerabilities fixed in Adobe Connect security bulletin APSB26-191, published on 10 November 2026.

The bulletin fixes 24 vulnerabilities in Adobe Connect 12.12 and earlier on Windows, of which 18 are rated Critical. Adobe rates the release Priority 2 and says it is not aware of any attacks exploiting the newly patched vulnerabilities. None of the 24 flaws is listed in CISA's Known Exploited Vulnerabilities catalogue.

What CVE-2026-121356 is

CVE-2026-121356 is a server-side request forgery, or SSRF, vulnerability. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, which means it is reachable over the network, low in complexity, needs no privileges and no user interaction, and changes scope, with high impact on confidentiality and integrity. Availability impact is set to none, yet the flaw still scores 10.0 because the scope change means the impact is not contained to the Connect application itself.

SSRF makes an internet-facing service act as a proxy for the internal network. On a meeting server, that can reach internal admin interfaces, cloud metadata services and internal application programming interfaces that were never meant to be reachable from outside. A second SSRF flaw, CVE-2026-121889, carries the same vector and the same 10.0 score, and both are confirmed at 10.0 by their own CVE records.

What else the bulletin fixes

The six 10.0 flaws span six different flaw classes, including path traversal, incorrect authorisation, CRLF injection, XML external entity processing, code injection and SQL injection. The full bulletin covers seven SQL injection flaws, four path traversals, three incorrect authorisations, two XXE flaws, one code injection, one CRLF injection, two stored cross-site scripting flaws and two reflected cross-site scripting flaws, alongside the two SSRF flaws.

Other high scores in the bulletin include CVE-2026-121887, an XXE flaw at 9.9, CVE-2026-121349, a path traversal flaw at 9.6, CVE-2026-121902, a SQL injection flaw at 9.4, and CVE-2026-121913, an incorrect authorisation flaw at 8.8. Adobe's own summary of the impact spans privilege escalation, arbitrary code execution, memory exposure and arbitrary file system read.

Why a meeting server is a valuable target

Adobe Connect is deployed for webinars, virtual classrooms and online meetings, which means it is reachable from the public internet by design, with a database behind it. It stores recorded meetings, uploaded slide decks and documents, chat transcripts, attendee lists and the authentication material for user accounts.

Seven SQL injection flaws on that surface are a direct route to the user table, the meeting archive and the content library. The two SSRF flaws reach a different class of asset, the internal services that Connect itself can reach. The XXE and path traversal flaws can read files from the server's file system, a first step in the chain from a web vulnerability to a host compromise.

How to update, and the build-table trap

Adobe has published five fixed builds, one per branch: 12.12.a, 12.11.i, 12.10.f, 12.9.a and 12.8.a. Administrators should update to the build for their own branch and confirm the suffix. An installation reporting version 12.12 with no suffix is still in the affected range, because the patch is 12.12.a, and a compliance check that only looks for 12.12 or later will wrongly report it as fixed.

Adobe Connect was the single largest and most severe bulletin in Adobe's November release, which fixed roughly 110 vulnerabilities across nine products, including Experience Manager, Audition, After Effects, Content Credentials SDK, Dimension, Media Encoder, Photoshop and Premiere. Connect and Experience Manager together account for 38 of those vulnerabilities. One researcher, credited as edra, reported 15 of the 24 Connect flaws, with Jim Green reporting five, archyxsec one and Diego one, through Adobe's bug bounty programme run via Intigriti. Adobe Connect administrators should apply the branch build now, restrict management and admin interfaces from untrusted networks, and review the instance for unexplained administrative accounts and content.