CVE-2026-75682

What is CVE-2026-75682?

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Timeline

• 2026-09-22Published to the U.S. National Vulnerability Database (NVD)
• 2026-09-24First covered in a defend.network daily briefing
• 2026-09-25NVD record last updated

Affected product

Adobe Connect (also: Apple, Microsoft)

NVD also lists CPE entries for: Adobe Connect, Adobe Connect For Mobile, Apple Macos, Microsoft Windows

References

• https://helpx.adobe.com/security/products/connect/apsb26-150.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-75682

Referenced in our briefings & reports

• Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation (2026-09-24)

Related vulnerabilities

• CVE-2026-11645 – Google Chromium V8 (same product)
• CVE-2026-34621 – Adobe Acrobat And Reader (same product)
• CVE-2026-5281 – Google Dawn (same product)
• CVE-2026-96951 – Microsoft Windows (same product)
• CVE-2026-86950 – Apple Multiple Products (same product)
• CVE-2026-81963 – Microsoft Windows (same product)

Adobe: 83 known exploited vulnerabilities (CISA KEV) →