AI analysis
Adobe Connect contains a SQL injection flaw (CWE-89) caused by improper neutralization of special elements in SQL commands, rated critical at CVSS 9.9. A low-privileged (authenticated) attacker can send crafted input over the network without any user interaction to execute arbitrary SQL commands, and Adobe states the issue could ultimately result in arbitrary code execution in the context of the current user. Because scope is changed, successful exploitation can impact resources beyond the vulnerable component, potentially letting the attacker elevate privileges or take over a victim's account or session. Both Adobe-hosted and self-hosted (on-premises) Adobe Connect deployments are in scope, though the source data does not specify exact affected version numbers. There is no public proof of concept, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation is presumed to be theoretical at this time.
What to do: Apply the vendor fix as soon as Adobe's PSIRT bulletin for CVE-2026-75682 publishes the patched build, prioritizing any internet-facing on-premises Connect servers and verifying their exact build version. Because exploitation requires only a low-privileged account, enforce least privilege for regular Connect users, audit the backing database for anomalous queries or unexpected privilege changes, and restrict network exposure of the Connect application and its database where possible. No vendor-documented workaround exists, so patching is the primary mitigation.
Estimated exposure
moderate≈1,000–10,000 internet-exposed self-hosted Adobe Connect servers (order of 10³), plus an additional population of Adobe-hosted SaaS tenants — Adobe Connect is a niche web-conferencing product relative to Zoom/Teams/Webex, and public internet scans typically show on the order of a few thousand internet-reachable self-hosted Connect instances, while hosted deployments are patched…
Description
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.