Advisory · CVE-2026-75682
SQL injection in Adobe Connect can lead to code execution
A SQL injection flaw in Adobe Connect lets a low-privileged attacker execute arbitrary SQL and reach code execution with changed scope. CVSS 9.9.
- Vendor
- Adobe
- Product
- Adobe Connect
- Identifier / CWE
- CVE-2026-75682
CWE-89 - Action timing
- Immediate
Explain it like I’m five
A meeting-room booking system passes your room name straight to the building engineer as an order. An attacker books a room named like an order, and the engineer carries it out.
- 01Low-privileged access
An attacker holds a low-privileged account on Adobe Connect.
- 02Malicious SQL
They inject SQL commands through a vulnerable parameter.
- 03Database control
The database executes the commands with the application's privileges.
- 04Code execution
The attacker reaches arbitrary code execution in the current user context, and can take over victim accounts or sessions.
What happened
Adobe security bulletin APSB26-150 addresses CVE-2026-75682, a SQL injection vulnerability (CWE-89) in Adobe Connect. A low-privileged attacker can exploit it without user interaction to execute arbitrary SQL commands, potentially gaining elevated access or control over victim accounts and sessions, with changed scope. Adobe Connect up to and including 12.11 and the Android mobile app up to and including 4.4; fixed in 12.11.1 / 12.12 and Android app 4.5. NVD rates it CVSS 9.9 (v3.1).
What to do
- Upgrade Adobe Connect to 12.11.1 or 12.12 (and the Android app to 4.5).
- Review database logs for unexpected SQL from application accounts.
- Force password resets for privileged Connect accounts if exploitation cannot be ruled out.
Management note
Connect hosts meetings, recordings, and attendee data; SQL injection there is a data-breach path, not just a server bug. Patch on-premise Connect deployments promptly.