A critical SQL injection vulnerability in Adobe Connect allows low privileged attackers to achieve remote code execution, posing a severe risk to system integrity.

This flaw is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89) that allows an authenticated attacker with low privileges to execute arbitrary SQL commands. The vulnerability does not require user interaction and, due to the changed scope, can lead to arbitrary code execution.

The potential for remote code execution represents a total compromise of the affected application environment. Given the CVSS score of 9.9, this vulnerability permits an attacker to bypass standard security controls, potentially leading to unauthorized data exfiltration, full system administrative control, or lateral movement within the corporate network.

Immediate Action: Update Adobe Connect to version 12.11.1 or 12.12, and update the Adobe Connect Android Mobile App to version 4.5 or later.

Proactive Monitoring: Review application access logs for unusual SQL query patterns or unexpected database activity originating from low privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting the Adobe Connect application interface.

Public Exploit Available: Unknown

This vulnerability carries a critical severity rating due to the potential for remote code execution and the low level of privileges required for exploitation. Administrators should prioritize the installation of the provided patches immediately. If immediate patching is not feasible, restrict network access to the application to trusted segments and implement strict input validation via WAF policies to mitigate the risk of successful SQL injection.