Critical CVSS 10.0 Security news
Adobe Connect and Experience Manager: November fixes include five CVSS 10.0 flaws
On Tuesday 10 November 2026 Adobe shipped security updates for its Adobe Connect webinar platform (24 flaws, 17 Critical) and for Adobe Experience Manager (14 flaws, four Critical). Five of the Connect flaws carry the maximum CVSS score of 10.0 and can be exploited over the network without signing in. Adobe says it is not aware of exploitation. If you run Connect on your own server or AEM 6.5, update soon.
Key points
- Who is affected: administrators of self-hosted Adobe Connect (Windows, 12.12 and earlier) and of Adobe Experience Manager 6.5, 6.5 LTS and Cloud Service.
- Adobe Connect (bulletin APSB26-191): 24 flaws, 17 Critical. Five of them – two SSRF bugs, a path traversal, an incorrect authorization and a CRLF injection – score CVSS 10.0 and need no authentication; Adobe rates their impact as privilege escalation. Eight more Critical bugs (SQL injection, XXE, path traversal, code injection) give code execution to an attacker with an ordinary account.
- Experience Manager (APSB26-189): four Critical CVSS 9.9 flaws (incorrect authorization and code injection) let a low-privileged user run code, plus ten medium-severity XSS and security feature bypass issues.
- Exploitation: none known to Adobe as of 10 November 2026, and no technical write-up or indicators have been published. What to do: Connect 12.12.a / 12.11.i / 12.10.f / 12.9.a / 12.8.a; AEM 6.5 and 6.5 LTS hotfix GRANITE-75052; AEM Cloud Service 2026.10.29251.
Vulnerabilities: CVE-2026-121356, CVE-2026-121351, CVE-2026-121889, CVE-2026-121352, CVE-2026-121353, CVE-2026-121902, CVE-2026-121355, CVE-2026-114371, CVE-2026-113580, CVE-2026-113579, CVE-2026-119017
What happened
Alongside its regular monthly release on Tuesday 10 November 2026, Adobe published two bulletins for server products that companies and universities often expose to the internet:
- APSB26-191 – Adobe Connect (webinars and online classes): 24 flaws, 17 Critical, 5 Important, 2 Moderate. Five of the Critical ones score CVSS 3.1 10.0 and require no authentication.
- APSB26-189 – Adobe Experience Manager (AEM, the content management system behind many large websites): 14 flaws, 4 Critical at CVSS 9.9 and 10 Moderate.
Both bulletins are Priority 2, and Adobe says it is not aware of exploitation.
| CVE | Product | Weakness | CVSS | Login needed |
|---|---|---|---|---|
| CVE-2026-121356 | Connect | SSRF (CWE-918) | 10.0 | no |
| CVE-2026-121889 | Connect | SSRF (CWE-918) | 10.0 | no |
| CVE-2026-121351 | Connect | path traversal (CWE-22) | 10.0 | no |
| CVE-2026-121352 | Connect | incorrect authorization (CWE-863) | 10.0 | no |
| CVE-2026-121353 | Connect | CRLF injection (CWE-93) | 10.0 | no |
| CVE-2026-121902 | Connect | SQL injection (CWE-89) | 9.4 | no |
| CVE-2026-121355 | Connect | incorrect authorization (CWE-863) | 9.1 | no |
| CVE-2026-114371 | AEM | incorrect authorization (CWE-863) | 9.9 | yes, low privileges |
| CVE-2026-119017 | AEM 6.5 | incorrect authorization (CWE-863) | 9.9 | yes, low privileges |
| CVE-2026-113580 | AEM | code injection (CWE-94) | 9.9 | yes, low privileges |
| CVE-2026-113579 | AEM | code injection (CWE-94) | 9.9 | yes, low privileges |
Technical details
Everything here comes from Adobe's bulletins and from the CVE records Adobe submitted to NVD (which NVD had not yet analysed as of 11 November). No researcher write-up has been published, and Adobe does not name the affected components or requests.
- Connect, no login (CVSS 10.0): two server-side request forgery bugs, which let an attacker make the server send requests to addresses of their choosing, typically internal hosts or interfaces. Also a path traversal that reads files outside the intended directory, an authorization check failure, and a CRLF injection (smuggling line breaks into headers or protocol data). The vector
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Nmeans a network attack with no account and no victim interaction, with impact beyond the application itself. Adobe classes the impact as privilege escalation. - Connect, ordinary account (CVSS 9.9): six SQL injections, an XXE, a code injection and two path traversals lead to code execution. Only a low-privileged account is required – on Connect that can be a webinar attendee or student if self-registration is enabled.
- AEM (CVSS 9.9): two authorization bugs and two code injections let a low-privileged AEM user run code without anyone else's interaction. The Moderate issues are mostly stored and DOM-based XSS (CVSS 5.4) plus one security feature bypass (CVE-2026-118482).
We do not publish exploitation details.
Who is affected
| Product | Vulnerable | Fixed |
|---|---|---|
| Adobe Connect (Windows) | 12.12 and earlier | 12.12.a, 12.11.i, 12.10.f, 12.9.a, 12.8.a |
| AEM 6.5 | Service Pack 25 and earlier | SP23–SP25 + Cumulative Hotfix GRANITE-75052 |
| AEM 6.5 LTS | Service Pack 3 and earlier | SP1–SP3 + Cumulative Hotfix GRANITE-75052 |
| AEM Cloud Service | 2026.10.29023 and earlier | 2026.10.29251 |
- AEM Forms: three DOM XSS bugs (CVE-2026-118479, -118480, -118481) are fixed on AEM 6.5 SP25 either by the Forms Add-on (version 6.0.1482) or, without the add-on, by the separate "Forms Hotfix for AEM 6.5 QuickStart 1.0.12". AEM 6.5 LTS without the Forms Add-on is not affected.
- AEM 6.5 only: CVE-2026-119017 and CVE-2026-118482. Cloud Service only: CVE-2026-123341.
- Most at risk are internet-facing Connect servers, especially with attendee self-registration, and AEM instances where outside authors or agencies hold accounts.
How to tell if you were compromised
Adobe has not published indicators of compromise and reports no attacks. What we suggest watching (our own advice, not Adobe guidance):
- Outbound connections from the Connect server to internal addresses, cloud metadata (169.254.169.254) or unknown hosts – a typical sign of SSRF.
- Requests containing
../,%2e%2eor%0d%0ain the access logs of the web server or proxy in front of Connect and AEM. - Database (SQL syntax) errors in Connect logs, and new processes spawned by the Connect service or by the AEM Java process.
- New accounts and group changes in Connect and AEM (administrators, authors), and new packages or bundles in AEM (Package Manager, OSGi console).
If Adobe or a CERT later publishes indicators, you can pull them out of the advisory with our IOC extractor. You can recalculate the vectors from the CVE records in the CVSS calculator.
What to do
- Self-hosted Adobe Connect: update to the fixed build for your branch (ideally 12.12.a) using the release notes linked from APSB26-191.
- Until Connect is patched, restrict admin and API access to the internal network or VPN and block outbound connections the server does not need (to blunt SSRF).
- AEM 6.5 and 6.5 LTS: apply Cumulative Hotfix GRANITE-75052 from Adobe Software Distribution; for forms, also the Forms Add-on 6.0.1482 or Forms Hotfix 1.0.12.
- AEM Cloud Service: check in Cloud Manager that environments run 2026.10.29251 or later.
- Review accounts: turn off Connect self-registration where you do not need it and audit outside author accounts in AEM – the Critical AEM bugs require a login.
Timeline
Updates
- 11 November 2026 – first version of the article.
FAQ
Are these flaws being exploited?
Both bulletins of 10 November 2026 say Adobe is not aware of any exploits, and none of the flaws is in CISA's KEV catalog. The bulletins are Priority 2 (a product that has been targeted before, exploitation not expected to be imminent; Adobe suggests patching within roughly 30 days). For unauthenticated CVSS 10 bugs on an internet-facing server we would not wait that long.
We use Adobe Connect as a hosted service. Do we need to do anything?
APSB26-191 covers the Windows release that organisations run themselves and links to on-premises release notes. It does not describe the hosted service. Ask Adobe, or the partner who runs Connect for you, whether the fix is already in place.
Does this affect AEM as a Cloud Service?
Yes, releases 2026.10.29023 and earlier. The fixed release is 2026.10.29251. We recommend checking in Cloud Manager that your environments are actually on it. Two flaws (CVE-2026-119017 and CVE-2026-118482) only affect AEM 6.5.
Why so many bugs from one researcher?
Most of the Critical flaws in both Connect and AEM were reported by a researcher going by edra, and most of the rest by Jim Green (green-jam), according to Adobe's acknowledgements. Batch reports like this are common when a researcher focuses on one product. Neither has published details yet.
Sources
- Adobe – APSB26-191: Security update available for Adobe Connect (10 Nov 2026)
- Adobe – APSB26-189: Security update available for Adobe Experience Manager (10 Nov 2026)
- NVD – CVE-2026-121352 (Adobe Connect, incorrect authorization)
- NVD – CVE-2026-119017 (Adobe Experience Manager, incorrect authorization)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.