Adobe Patches Critical Flaws in Connect, AEM Forms
Adobe patched 36 vulnerabilities, including critical code-execution SQL injection, XSS, and SSRF flaws in Connect and Experience Manager Forms; no known exploitation.
Adobe released patches for 36 vulnerabilities, with critical flaws in Adobe Connect and Experience Manager (AEM) Forms. The Connect update fixes nine bugs, six of them critical (SQL injection, XSS, improper input validation) enabling arbitrary code execution and privilege escalation. AEM Forms gets six fixes including three critical issues (incorrect authorization, improper input validation, SSRF) leading to code execution and privilege escalation. Both bulletins carry priority 2 rating (patch within 30 days); Adobe is not aware of in-the-wild exploitation.
- Adobe Connect: 9 fixes, 6 critical, enabling code execution and privilege escalation.
- AEM Forms: 6 fixes, 3 critical SSRF/authorization/input validation issues.
- Both updates rated priority 2, meaning apply within 30 days.
- No exploitation in the wild reported by Adobe.
- CVEs
- CVE-2026-75682CVE-2026-75684CVE-2026-75686CVE-2026-75689CVE-2026-75697CVE-2026-75698CVE-2026-75745CVE-2026-81995CVE-2026-82000
- Organizations
- Adobe
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75682 | Authenticated SQL Injection Leading to Code Execution in Adobe Connect | 9.9 group max | — | ||
CVE-2026-75745+1 related CVE | Unauthenticated RCE via Broken Authorization in Adobe Experience Manager Forms JEE | 10.0 group max | — | ||
| CVE-2026-81995 | Privileged RCE via Input Validation Flaw in Adobe Experience Manager Forms JEE | 9.1 | — |
From the original article
1 min read at securityweek.com
The nine critical security defects could be exploited for arbitrary code execution and privilege escalation. The post Adobe Patches Critical Flaws in Connect, AEM Forms appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.