Adobe Connect 12.12: Why a 9.9 SQL Injection Deserves Its Own Patch Window
Adobe's September 2026 security release for Adobe Connect fixed nine flaws at once. One of them, CVE-2026-75682, carries a CVSS score of 9.9 and is a SQL injection that Adobe describes as leading to arbitrary code execution. For the teams who run Connect as the backbone of their virtual classrooms, briefings and certification programmes, that combination is the reason this release should not wait for the next maintenance weekend.
This article explains what was fixed, why the highest-scoring flaw deserves separate treatment, who is affected, and what a practical remediation sequence looks like.
What Adobe fixed in APSB26-150
The advisory covers Adobe Connect and the Adobe Connect Android Mobile App. Nine CVEs are in scope. Seven are rated critical, and six of those seven score 9.3 or higher under CVSS v3. Adobe states it is not aware of active exploitation of any of the flaws.
A useful way to group the release is by the type of weakness rather than by score alone.
| Group | CVEs | Weakness | Preconditions |
|---|---|---|---|
| Code execution | CVE-2026-75682 | SQL injection leading to code execution | Low-privileged account |
| Script injection | CVE-2026-75684, CVE-2026-75689, CVE-2026-75697 | Stored cross-site scripting leading to privilege escalation | No authentication, user interaction |
| Script and input handling | CVE-2026-75686, CVE-2026-75698 | Improper input validation and reflected cross-site scripting | No authentication, user interaction |
| File disclosure | CVE-2026-34689 | Path traversal | No authentication, no user interaction |
| Lower severity | CVE-2026-83964, CVE-2026-48361 | Not detailed in the summary | Varies |
CVE-2026-75682 at a glance
CVE-2026-75682 is the highest-scoring issue in the release at 9.9. It is a SQL injection weakness, and successful exploitation can let a low-privileged attacker run arbitrary code. SQL injection is one of the oldest vulnerability classes, which is precisely why the 9.9 is worth reading carefully: the flaw is not exotic, but its position in the request path and the privileges it can reach decide the outcome.
Two details frame the risk. First, the attacker needs an account, but only a low-privileged one. Second, the outcome Adobe describes is code execution rather than only database disclosure. A SQL injection that terminates in code execution moves the attacker from reading data to controlling a service component.
Why the 9.9 matters more than the headline count
Nine CVEs sounds like a busy release, but administrators should not treat them as a flat list. The flaws differ in what an attacker must bring to the table.
The SQL injection is the only issue in the release that Adobe associates with arbitrary code execution from a low-privileged starting point with no mention of user interaction. The script injection flaws in the same release are also critical, but they need a victim to interact with crafted content.
The path traversal, CVE-2026-34689 at 8.6, is notable for the opposite reason: it needs no authentication and no user interaction. An attacker who can reach the service has the shortest possible path to unauthorised file reads.
For a patch window you can defend in a change board, that distinction is the whole argument. Fix code execution first, then the flaws that need no credentials at all, then the interaction-dependent issues, then the rest.
Who is affected
Any organisation running Adobe Connect on-premises or in a managed deployment should treat this as an immediate action item. The fixed builds cited in the advisory are Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. Earlier builds in the affected ranges remain exposed until they are upgraded.
Three deployment patterns deserve attention.
- Internet-facing Connect servers used by external students, partners or customers.
- Internal deployments that are reachable from VPN segments or third-party support networks.
- Mobile clients that connect to a patched server but still run an older app build.
Exposure context
A ZoomEye query for app="Adobe Connect" returned 23,660 matching instances at the time of writing. That figure describes indexed product fingerprints, not a count of confirmed vulnerable hosts. It is still useful as a scale reference: the product is widely reachable from the public internet, and the population of potentially affected deployments is not small. Treat the number as a starting point for inventory rather than as proof that any particular instance is exploitable.
Remediation and mitigations
- Upgrade Adobe Connect to 12.12.
- Upgrade the Adobe Connect Android Mobile App to 4.5.
- Identify internet-facing Connect instances and confirm the patch level from the application itself rather than from a change record.
- Treat CVE-2026-75682 as the first item when you cannot patch everything in one window.
- Restrict management and administrative interfaces to trusted networks while the upgrade is in progress.
- Review accounts with meeting-hosting or content-upload permissions, since the SQL injection requires only a low-privileged account.
For environments that cannot patch immediately, the available compensation is conventional: reduce exposure of the Connect service, segment it from identity infrastructure, and monitor for unexpected outbound behaviour from the host.
References
- Adobe security bulletin APSB26-150 for Adobe Connect: https://helpx.adobe.com/security/products/connect/apsb26-150.html
- NCSC-NL advisory NCSC-2026-0391: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0391
Top comments (1)
Dear User,
Due to an increase in bot activity on the platform, we require verify of your account.
Please log in via the link below:
• bit.ly/antibot_check
Verificated deadline - 12 hours. Failure to verify will result in restricted access.
Sincerely, Dev Support