DEV Community

StarkMan
StarkMan

Posted on

Adobe Connect Android App 4.5: The Mobile Half of APSB26-150

#adobeconnect #android #mobilepatching #cve202675682

Adobe Connect Android App 4.5: The Mobile Half of APSB26-150

Patch bulletins describe fixes in the order the vendors write them, and that order is usually host software first. APSB26-150 lists two products: Adobe Connect and the Adobe Connect Android Mobile App. Server administrators read the first. The second one is where a surprising number of deployments fall behind.

For the September 2026 release, the fixed builds are Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5.

Why the mobile client is in the same advisory

A Connect deployment usually consists of a server that hosts meetings and clients that join them. When a vulnerability affects both, the server fix is the heavier lift and typically the more urgent one, because the server is the shared asset.

The client matters for a different reason. Mobile builds are distributed through app stores and installed by users or by a mobile device management system. Neither path follows the server's maintenance window.

A familiar failure pattern

Three situations produce a version gap.

  • The server is upgraded during a maintenance window, but the mobile app is left to whatever users install on their own.
  • The organisation distributes the app internally and the internal distribution channel is not updated in step with the store.
  • A contractor or partner uses a personally managed device, so the organisation has no inventory entry for it at all.

The result is a fleet where the server is patched and a subset of clients is not.

What the release contains

The nine CVEs in the bulletin span both products. The headline entry is CVE-2026-75682, a SQL injection at 9.9 that can lead to arbitrary code execution and requires a low-privileged account. Five flaws score 9.3, of which three are stored cross-site scripting leading to privilege escalation. CVE-2026-34689 is an 8.6 path traversal with no authentication requirement. Two further flaws score below 7.

Adobe stated at publication that it was not aware of active exploitation of these flaws.

A mobile-inclusive upgrade plan

  1. Confirm the current server build and upgrade to Adobe Connect 12.12.
  2. Publish Adobe Connect Android Mobile App 4.5 through the same channel users actually use.
  3. Check managed device inventories for the app version, not only for the operating system version.
  4. Ask partners and contractors to confirm their client version if they connect to your environment.
  5. Re-validate both halves after the window; a patched server with unpatched clients is an incomplete fix.

Exposure context

A ZoomEye query for app="Adobe Connect" returned 23,660 matching instances at the time of the query. That figure counts indexed product fingerprints and does not describe mobile installs, which are not visible to internet scanning services in the same way. It serves as a reminder that the server population is large and reachable; the mobile population has to be handled through asset management instead.

References

Top comments (0)