CVE-2026-121353

Summary

Adobe Connect contains a CRLF injection vulnerability (CWE-93) that allows unauthenticated attackers to inject carriage return and line feed characters into HTTP responses, potentially enabling session fixation, header injection, or UI redressing attacks that could lead to account takeover or arbitrary code execution in the user's context. The vulnerability has a changed scope, indicating broader impact than initially assumed.

Exploitability

Exploitation requires no user interaction and can be performed remotely by an unauthenticated attacker due to the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation could allow attackers to hijack user sessions, inject malicious content into responses, or escalate privileges, potentially compromising multiple users and gaining unauthorized access to sensitive meeting data or administrative functions.

Detection

Defenders should monitor web server access logs for HTTP requests containing unencoded CRLF sequences (%0d%0a or %0a) in query parameters, headers, or form fields—especially those targeting meeting join URLs, login endpoints, or API routes—and correlate with anomalous response headers such as duplicate Set-Cookie entries or unexpected Location headers. No reliable host-based indicators are expected.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, which includes a fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.