CVE-2026-121902

Summary

Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special characters in SQL commands, allowing unauthenticated remote attackers to execute arbitrary SQL queries without user interaction. This could lead to full data exfiltration, unauthorized modification, or service disruption.

Exploitability

Exploitation is straightforward for remote attackers as it requires no authentication, user interaction, or special conditions—only network access to the vulnerable Adobe Connect endpoint.

Blast radius

Successful exploitation could result in complete compromise of backend database confidentiality and integrity, with potential denial of service due to database manipulation or resource exhaustion.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Connect version 2.590 or later, as this is the fixed version published by Adobe for CVE-2026-121902.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.