Adobe Connect APSB26-191: Six CVSS 10.0s, Five Branches, One Suffix That Breaks Your Scanner
Adobe dropped 24 CVEs in Adobe Connect on November 10. Eighteen are Critical. Six are CVSS 10.0. Every one of the six 10.0s shares the same vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N . Network-reachable, no authentication, no user interaction, scope changed. No precondition an attacker has to work around. Two are confirmed by their own CVE records: CVE-2026-121356 and CVE-2026-121889, both SSRF.…
On November 10, Adobe released 24 CVEs for Adobe Connect, with eight being Critical and six sharing the same CVSS 10.0 rating. All six 10.0 vulnerabilities have the same vector: Network-reachable, no authentication, no user interaction, and a scope change. Two of the six are SSRF, while the others include path traversal, XXE, code injection, and SQL injection.
This suggests that input validation was inconsistent throughout the codebase, with researcher edra identifying every instance where it was not enforced. Adobe provides five fixed builds, each corresponding to a different branch, but a server without a suffix remains vulnerable. String comparison, including the alphabetic suffix, is the correct method to check for updates.
The vulnerabilities range from SQL injection to XSS, all of which are in the OWASP Top 10. Adobe stated it is not aware of any exploits in the wild as of November 11, but the 10.0 SSRF rating indicates that a short research project could potentially weaponize the vulnerability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
