Adobe Connect 12.12: Why a 9.9 SQL Injection Deserves Its Own Patch Window

Adobe's September 2026 security release for Adobe Connect fixed nine flaws at once. One of them, CVE-2026-75682, carries a CVSS score of 9.9 and is a SQL injection that Adobe describes as leading to arbitrary code execution. For the teams who run Connect as the backbone of their virtual classrooms, briefings and certification programmes, that combination is the reason this release should not wait for the next maintenance weekend.

This article explains what was fixed, why the highest-scoring flaw deserves separate treatment, who is affected, and what a practical remediation sequence looks like.

What Adobe fixed in APSB26-150

The advisory covers Adobe Connect and the Adobe Connect Android Mobile App. Nine CVEs are in scope. Seven are rated critical, and six of those seven score 9.3 or higher under CVSS v3. Adobe states it is not aware of active exploitation of any of the flaws.

A useful way to group the release is by the type of weakness rather than by score alone.

Group	CVEs	Weakness	Preconditions
Code execution	CVE-2026-75682	SQL injection leading to code execution	Low-privileged account
Script injection	CVE-2026-75684, CVE-2026-75689, CVE-2026-75697	Stored cross-site scripting leading to privilege escalation	No authentication, user interaction
Script and input handling	CVE-2026-75686, CVE-2026-75698	Improper input validation and reflected cross-site scripting	No authentication, user interaction
File disclosure	CVE-2026-34689	Path traversal	No authentication, no user interaction
Lower severity	CVE-2026-83964, CVE-2026-48361	Not detailed in the summary	Varies

CVE-2026-75682 at a glance

CVE-2026-75682 is the highest-scoring issue in the release at 9.9. It is a SQL injection weakness, and successful exploitation can let a low-privileged attacker run arbitrary code. SQL injection is one of the oldest vulnerability classes, which is precisely why the 9.9 is worth reading carefully: the flaw is not exotic, but its position in the request path and the privileges it can reach decide the outcome.

Two details frame the risk. First, the attacker needs an account, but only a low-privileged one. Second, the outcome Adobe describes is code execution rather than only database disclosure. A SQL injection that terminates in code execution moves the attacker from reading data to controlling a service component.

Why the 9.9 matters more than the headline count

Nine CVEs sounds like a busy release, but administrators should not treat them as a flat list. The flaws differ in what an attacker must bring to the table.

The SQL injection is the only issue in the release that Adobe associates with arbitrary code execution from a low-privileged starting point with no mention of user interaction. The script injection flaws in the same release are also critical, but they need a victim to interact with crafted content.

The path traversal, CVE-2026-34689 at 8.6, is notable for the opposite reason: it needs no authentication and no user interaction. An attacker who can reach the service has the shortest possible path to unauthorised file reads.

For a patch window you can defend in a change board, that distinction is the whole argument. Fix code execution first, then the flaws that need no credentials at all, then the interaction-dependent issues, then the rest.

Who is affected

Any organisation running Adobe Connect on-premises or in a managed deployment should treat this as an immediate action item. The fixed builds cited in the advisory are Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. Earlier builds in the affected ranges remain exposed until they are upgraded.

Three deployment patterns deserve attention.

Internet-facing Connect servers used by external students, partners or customers.
Internal deployments that are reachable from VPN segments or third-party support networks.
Mobile clients that connect to a patched server but still run an older app build.

Exposure context

A ZoomEye query for app="Adobe Connect" returned 23,660 matching instances at the time of writing. That figure describes indexed product fingerprints, not a count of confirmed vulnerable hosts. It is still useful as a scale reference: the product is widely reachable from the public internet, and the population of potentially affected deployments is not small. Treat the number as a starting point for inventory rather than as proof that any particular instance is exploitable.

Remediation and mitigations

Upgrade Adobe Connect to 12.12.
Upgrade the Adobe Connect Android Mobile App to 4.5.
Identify internet-facing Connect instances and confirm the patch level from the application itself rather than from a change record.
Treat CVE-2026-75682 as the first item when you cannot patch everything in one window.
Restrict management and administrative interfaces to trusted networks while the upgrade is in progress.
Review accounts with meeting-hosting or content-upload permissions, since the SQL injection requires only a low-privileged account.

For environments that cannot patch immediately, the available compensation is conventional: reduce exposure of the Connect service, segment it from identity infrastructure, and monitor for unexpected outbound behaviour from the host.