.

Adobe Security Bulletin

Last updated on Sep 22, 2026

Security update available for Adobe Connect | APSB26-150

Bulletin ID
Date published
Priority
APSB26-150
September 22, 2026
2
style
grid width 12

Summary

Adobe has released a security update for Adobe Connect. This update resolves critical and important vulnerabilities that could result in arbitrary code execution, arbitrary file system read, privilege escalation, and security feature bypass.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Product Versions

Product
Version
Platform
Adobe Connect
12.11 and earlier
Windows and macOS
Adobe Connect Android Mobile App
4.4 and earlier
Android
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the latest version.

Product
Version
Platform
Priority
Availability
Adobe Connect
12.12
Windows and macOS
2
Release Notes
Adobe Connect Android Mobile App
4.5
Android
2
Release Notes
style
grid width 12

Vulnerability Details

Vulnerability category
Vulnerability impact
Severity
CVSS base score
CVSS vector
CVE number
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Arbitrary code execution
Critical
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-75682
Cross-site Scripting (Stored XSS) (CWE-79)
Privilege escalation
Critical
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-75684
Improper Input Validation (CWE-20)
Arbitrary code execution
Critical
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-75686
Cross-site Scripting (Stored XSS) (CWE-79)
Privilege escalation
Critical
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-75689
Cross-site Scripting (Stored XSS) (CWE-79)
Privilege escalation
Critical
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-75697
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Critical
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-75698
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Arbitrary file systeam read
Critical
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE-2026-34689
Improper Certificate Validation (CWE-295)
Security feature bypass
Important
6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2026-83964
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2026-48361

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments

Adobe would like to thank the following researchers for reporting these issue and for working with Adobe to help protect our customers:

  • Diego (goedix) — CVE-2026-75682
  • Tomi (archyxsec) — CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697
  • Jim Green (green-jam) — CVE-2026-75698
  • curiositysec — CVE-2026-34689
  • Sergio Framinan Garcia (sergioframi) — CVE-2026-48361

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.