How severe is CVE-2018-12805?

CVE-2018-12805 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-12805 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-12805?

CVE-2018-12805 affects Adobe Connect. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-12805?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-12805 published?

CVE-2018-12805 was published on 2018-07-20 and last updated on 2026-06-17.

CVE-2018-12805

CVE-2018-12805 is a critical-severity vulnerability in Adobe Connect with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-427.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 4% (90th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-427
Affected product: Adobe Connect
Published: 2018-07-20
Last modified: 2026-06-17

Description

Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation.

Frequently asked questions

What is CVE-2018-12805?: Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation.
How severe is CVE-2018-12805?: CVE-2018-12805 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-12805 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-12805?: CVE-2018-12805 affects Adobe Connect. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-12805?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-12805 published?: CVE-2018-12805 was published on 2018-07-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*

More vulnerabilities in Adobe Connect

CVE-2017-11291 — Critical (CVSS 10.0): An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-75682 — Critical (CVSS 9.9): Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')…
CVE-2023-4662 — Critical (CVSS 9.8): Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This…
CVE-2023-4661 — Critical (CVSS 9.8): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira…
CVE-2021-40719 — Critical (CVSS 9.8): Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve…
CVE-2018-12804 — Critical (CVSS 9.8): Adobe Connect versions 9.7.5 and earlier have an Authentication Bypass vulnerability. Successful exploitation could…

All CVEs affecting Adobe Connect →

Other CWE-427 (Uncontrolled Search Path Element) vulnerabilities

CVE-2026-65093 — Critical (CVSS 9.9): NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful…
CVE-2026-16860 — Critical (CVSS 9.9): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an…
CVE-2025-4981 — Critical (CVSS 9.9): Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to…
CVE-2025-69599 — Critical (CVSS 9.8): RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH…
CVE-2019-25268 — Critical (CVSS 9.8): NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking…
CVE-2023-53959 — Critical (CVSS 9.8): FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by…

Browse all CWE-427 (Uncontrolled Search Path Element) vulnerabilities →