CVE-2026-121887

Summary

Adobe Connect contains an XXE vulnerability (CWE-611) in its XML parsing logic that allows a low-privileged attacker to trigger external entity resolution, potentially leading to arbitrary code execution in the context of the current user. The vulnerability is exploitable remotely without user interaction and has a changed scope, indicating broader impact than initially assumed.

Exploitability

Exploitation requires only low privileges and network access; no user interaction is needed, making it highly exploitable for authenticated attackers.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability loss for the affected Adobe Connect instance and potentially downstream systems depending on deployment architecture.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, which contains a fix for CVE-2026-121887.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.