CVE-2026-121889

Summary

Adobe Connect contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate the application into making unintended internal or external HTTP requests, potentially leading to privilege escalation due to a changed scope.

Exploitability

Exploitation requires no user interaction or prior authentication and leverages network-accessible SSRF entry points in Adobe Connect.

Blast radius

Successful exploitation could enable attackers to access internal services, bypass network segmentation, and escalate privileges within the Adobe Connect environment.

Detection

Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the Adobe Connect server to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16–31.x.x) or unexpected external domains in web server access logs and proxy logs; look for repeated requests with non-standard User-Agent strings or unusual request paths originating from the application server.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later; if that version is not yet available, restrict SSRF-prone endpoints to trusted IP ranges and disable unnecessary outbound request functionality per Adobe security advisory guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.