CVE-2026-121356

Summary

Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate the application into making unintended internal or external HTTP requests, potentially leading to privilege escalation due to the changed scope.

Exploitability

Exploitation requires no user interaction or prior authentication and leverages network-accessible SSRF endpoints without additional constraints mentioned.

Blast radius

Successful exploitation could enable attackers to access internal services, bypass network segmentation, and escalate privileges within the Adobe Connect environment.

Detection

Defenders should monitor Adobe Connect access logs for anomalous outbound HTTP requests to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x), localhost (127.0.0.1), or metadata endpoints (e.g., 169.254.169.254); unexpected User-Agent strings or high-frequency requests to non-standard ports may also indicate exploitation attempts.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, which contains the official fix for this SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.