Adobe Connect APSB26-191: Six CVSS 10.0s, Five Branches, One Suffix That Breaks Your Scanner

Adobe dropped 24 CVEs in Adobe Connect on November 10. Eighteen are Critical. Six are CVSS 10.0.

Every one of the six 10.0s shares the same vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Network-reachable, no authentication, no user interaction, scope changed. No precondition an attacker has to work around.

Two are confirmed by their own CVE records: CVE-2026-121356 and CVE-2026-121889, both SSRF. The other four sit across path traversal, XXE, code injection, and SQL injection - six different flaw classes landing on the same score.

That's not a cluster. That's a codebase where input validation was inconsistent, and a researcher (edra, credited for 15 of the 24) found every place it wasn't enforced.

Fixed Builds

The build table is the real problem. Adobe provides five fixed builds, one per branch:

A server on 12.12 with no suffix is still vulnerable. A patch scanner that compares integers (>= 12.12) will show green. The suffix is the version.

This matters if you're writing detection logic, compliance checks, or SIEM rules against installed software versions. String comparison on the full version - including the alphabetic suffix - is the only correct check.

Flaw Mix

What the flaw mix looks like for a developer:

• 7 SQL injection (CWE-89) - parametrized queries or ORM not used consistently
• 4 path traversal (CWE-22) - file path inputs not canonicalized before use
• 2 SSRF (CWE-918) - outbound URL inputs not validated against an allowlist
• 2 XXE (CWE-611) - XML parser configured with external entity resolution enabled
• 1 code injection - user input reaching an eval or similar execution context
• 1 CRLF injection - HTTP header construction from unescaped input
• 3 incorrect authorization (CWE-863) - privilege checks missing or bypassable
• 4 XSS - output encoding not applied consistently

None of these is an exotic class. All of them are in the OWASP Top 10. The finding is that a mature, shipping product hadn't applied consistent defenses across its own surface.

Exploitation Status

No known exploitation - for now. Adobe states it's not aware of exploits in the wild, and nothing is in CISA KEV as of November 11. That's accurate as of today.

A 10.0 SSRF with no auth requirement is a short research project to weaponize. Seven SQL injections on an internet-facing meeting server are automatable with off-the-shelf tooling. "Not aware of exploitation" is a timestamp.

Full breakdown Priority order, hunt queries, and mitigation checklist: 👉 https://threataft.com/articles/adobe-connect-apsb26-191-mass-disclosure-24-cves