CVE-2018-12804

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.09.8Critical EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-07-20Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

n/a Adobe Connect 9.7.5 and earlierAffected: Adobe Connect 9.7.5 and earlierUpgrade to: not statedStated by: CVE record
Adobe ConnectAffected: ≤ 9.7.5Upgrade to: after 9.7.5Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Adobe Connect software version and confirm whether it is 9.7.5 or earlier.
Compare your version against the remediation guidance in Adobe’s APSB18-22 advisory.
Upgrade Adobe Connect to the fixed version(s) listed in APSB18-22 (as provided by Adobe for this issue).
If you cannot upgrade immediately, restrict network access to Adobe Connect so it is not reachable from the public internet and only allowed from trusted networks/VPN users (then schedule the upgrade as soon as possible).

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Connect versions 9.7.5 and earlier have an Authentication Bypass vulnerability. Successful exploitation could lead to session hijacking.

In plain language

Written by AI from the record

Adobe Connect 9.7.5 and earlier can be tricked into skipping login checks, which may let an attacker take over a user’s session; if you run this older Connect version, you should act now.

CWE-287 Authentication Bypass in Adobe Connect; in vulnerable versions (9.7.5 and earlier) an attacker can bypass authentication and, after that, hijack an active session.

If you're affected

Session takeover of users
Unauthorized access to meetings
Account and content compromise
Service disruption risk

What is it

This vulnerability is like a door lock that can be forced to think you’re “already allowed in.” If someone finds a way to hit the weakness, they could take over a real user’s session—meaning they could appear to be that user inside Adobe Connect.
Think of it as “someone impersonating a logged-in person” during a meeting or workflow.

Who is affected

This matters if you use or host Adobe Connect and your installation is 9.7.5 or earlier. In that case, the login protections for Adobe Connect can be bypassed.
Whether you’re at risk depends on whether an attacker can reach the Adobe Connect service from the network you expose (for example, via the public internet), and whether they can interact with it successfully.

How urgent is it

Treat this as urgent because the weakness is designed to bypass authentication and can result in session hijacking. While there is no public exploit code on record in the provided findings and it is not listed in CISA KEV, the overall likelihood signals and rising attention mean you should prioritize upgrading.
Follow through quickly to get onto Adobe’s fixed release from the APSB18-22 advisory.

What to do — in detail

Confirm exposure (version check)
- Identify the exact Adobe Connect server version (and confirm it is 9.7.5 or earlier).
- If you run multiple Connect nodes/environments (prod, staging, DR), check all of them.
Determine the fixed release(s)
- Use Adobe’s remediation advisory APSB18-22 for CVE-2018-12804 and find the fixed Adobe Connect version(s) specified there.
- Ensure your upgrade target is a version that is newer than 9.7.5 and matches Adobe’s guidance for this CVE.
Plan and perform the upgrade
- Schedule the maintenance window required by your Connect deployment method.
- Upgrade all affected Connect instances to the fixed version(s) from APSB18-22.
- If the upgrade changes configuration, follow Adobe’s upgrade steps and validate afterward (login behavior, meeting access, and admin console access).
Temporary mitigation if you can’t upgrade right away
- Reduce network exposure: ensure Adobe Connect is not directly reachable from the public internet where possible.
- Allow only required source IPs (e.g., office IPs) or require VPN / trusted network paths.
- Review perimeter and reverse-proxy rules so only intended users can reach the Connect endpoints.
- Monitor for unusual authentication/session behavior in application logs during the interim.
After upgrade / verification
- Confirm the running version matches the fixed version from APSB18-22.
- Conduct a quick functional test: log in as admin and a non-admin user, create/join a meeting, and confirm sessions behave normally.

Note: KEV (CISA) is not listed for this issue in the provided findings, and no public exploit code was found there; however, the weakness is serious enough to justify timely patching based on the published remediation guidance.

Technical context

CVE-2018-12804 is an Authentication Bypass issue (CWE-287) affecting Adobe Connect 9.7.5 and earlier. The expected impact of successful exploitation is session hijacking: an attacker bypasses normal authentication controls and can then take over an existing authenticated session.

Findings highlights: the issue is not listed in CISA KEV and no public exploit code was found in the provided findings, but vendor remediation exists (Adobe APSB18-22) and predicted exploitation likelihood is described as rising (not used as a public claim of exploitation). Public exploit maturity is therefore not confirmed here, but the authentication bypass + session hijacking outcome makes patching the priority.

Attack vector (high level): remotely reaching the vulnerable Adobe Connect service and triggering the authentication bypass mechanism so the attacker can access authenticated context.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 2987 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band changelow → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

adobecommercial · USaka adobe systems inc.
- connectConsumer Software

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable