CVE-2026-121894

Summary

Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of user-supplied input in SQL commands. A low-privileged attacker can exploit this without user interaction to execute arbitrary SQL, potentially escalating privileges or compromising data integrity and confidentiality.

Exploitability

Exploitation requires only low-privileged network access and no user interaction; the vulnerability is trivially exploitable given knowledge of the vulnerable endpoint and input vector.

Blast radius

Successful exploitation could enable full compromise of the application’s database, leading to unauthorized data exfiltration, privilege escalation, or remote code execution depending on database permissions and backend configuration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, which contains the vendor-provided fix for this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.