CVE-2026-121892

Summary

Adobe Connect contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in their own context without user interaction, due to improper control over code generation. The vulnerability has a changed scope, indicating it affects components beyond the immediate attack surface.

Exploitability

Exploitation requires only low privileges and no user interaction, making it highly exploitable by authenticated attackers with minimal access.

Blast radius

Successful exploitation could lead to full compromise of the affected system including confidentiality, integrity, and availability impacts within the current user context, potentially enabling lateral movement or persistent access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, as this is the fixed version specified in the advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.