CVE-2026-121896

Summary

Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special SQL elements in user-supplied input. A low-privileged attacker can exploit this without user interaction to execute arbitrary code in the context of the current user, with scope changed from original to connected system.

Exploitability

Exploitation requires low privileges and network access but no user interaction; it is straightforward for an authenticated attacker targeting vulnerable input fields that feed into SQL queries.

Blast radius

Successful exploitation could lead to full compromise of the Adobe Connect server, including data exfiltration, privilege escalation, and lateral movement within the connected infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, as this is the fixed version that addresses CVE-2026-121896.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.