Adobe Security Updates — November 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 21

• Critical 10.0
  CVE-2026-121351 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
• Critical 10.0
  CVE-2026-121352 Adobe Connect | Incorrect Authorization (CWE-863)
• Critical 10.0
  CVE-2026-121353 Adobe Connect | Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
• Critical 10.0
  CVE-2026-121356 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918)
• Critical 10.0
  CVE-2026-121889 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918)
• Critical 9.9
  CVE-2026-113579 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)
• Critical 9.9
  CVE-2026-113580 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)
• Critical 9.9
  CVE-2026-114371 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 9.9
  CVE-2026-119017 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 9.9
  CVE-2026-121354 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
• Critical 9.9
  CVE-2026-121887 Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
• Critical 9.9
  CVE-2026-121892 Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
• Critical 9.9
  CVE-2026-121894 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
• Critical 9.9
  CVE-2026-121896 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
• Critical 9.9
  CVE-2026-121898 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
• Critical 9.9
  CVE-2026-121906 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
• Critical 9.9
  CVE-2026-121908 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
• Critical 9.6
  CVE-2026-121349 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
• Critical 9.6
  CVE-2026-121904 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts in…
• Critical 9.4
  CVE-2026-121902 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
• Critical 9.1
  CVE-2026-121355 Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability t…

All vulnerabilities 110