Adobe Patches Critical Connect and AEM Forms Flaws Among 36 Vulnerabilities
Summary
Adobe patched 36 vulnerabilities across its products, including critical flaws in Connect and AEM Forms that could enable code execution or privilege escalation. Adobe says it is unaware of exploitation in the wild.
Key points
- Connect fixes nine vulnerabilities, including six critical flaws involving SQL injection, XSS, and improper input validation.
- AEM Forms fixes six vulnerabilities, including three critical flaws involving authorization, input validation, and server-side request forgery.
- The updates also address high-severity issues that could enable file reads, privilege escalation, code execution, or security feature bypass.
- Adobe recommends applying both priority 2 updates within 30 days.
- Adobe says it is not aware of exploitation of the vulnerabilities in the wild.
- Adobe also fixed high- and medium-severity flaws in InDesign, Content Credentials SDK, Bridge, Substance 3D Modeler, and Premiere Pro.
Article Details
- Vulnerability Types
- SQL injection
- Cross-site scripting (XSS)
- Improper input validation
- Path traversal
- Improper certificate validation
- Incorrect authorization
- Server-side request forgery (SSRF)
- Cross-site request forgery (CSRF)
- Severity
- Critical and high
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-75682Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75684Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75686Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75689Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75697Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75698Adobe · Connect; Adobe · Connect for mobileTracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.CVE-2026-75745Vendor / Product unavailableDescribed as incorrect authorization, improper input validation, and server-side request forgery (SSRF), the critical issues are tracked as CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000.CVE-2026-81995Vendor / Product unavailableDescribed as incorrect authorization, improper input validation, and server-side request forgery (SSRF), the critical issues are tracked as CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000.CVE-2026-82000Vendor / Product unavailableDescribed as incorrect authorization, improper input validation, and server-side request forgery (SSRF), the critical issues are tracked as CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000.
Vendors
Products
Adobe Experience Manager FormsAdobe on Tuesday rolled out patches for 36 vulnerabilities across its products, including critical-severity flaws in Connect and Experience Manager (AEM) Forms.ConnectAdobe on Tuesday rolled out patches for 36 vulnerabilities across its products, including critical-severity flaws in Connect and Experience Manager (AEM) Forms.