CVE-2026-121349

Summary

Adobe Connect contains a path traversal vulnerability (CWE-22) that allows a low-privileged attacker to escape directory restrictions by manipulating file paths, potentially leading to unauthorized access or arbitrary code execution in the current user's context. The vulnerability is exploitable over the network without user interaction and involves a scope change, indicating broader impact than initially intended.

Exploitability

Exploitation requires only low-privileged network access and no user interaction, making it highly exploitable by authenticated attackers.

Blast radius

Successful exploitation could allow an attacker to read or write arbitrary files on the server, escalate privileges, or execute code in the context of the vulnerable service, potentially compromising the entire application environment.

Detection

Defenders should monitor for anomalous file access patterns in web server logs (e.g., requests containing sequences like ../ or %2e%2e/ targeting non-public directories), especially from low-privileged users; look for unexpected file creation or modification events in application logs tied to user-initiated actions.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.