Critical severity · published Sep 22, 2026
CVE-2026-75686
Adobe Connect | Improper Input Validation (CWE-20)
9.3
CVSS
0.9%
EPSS
No
On KEV
Description
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Adobe Connect · Adobe
through 12.11 · source: vendor
AC
Adobe Connect Android Mobile App · Adobe
through 4.4 · source: vendor
CO
Connect · Adobe
before 12.12 · source: NVD
CF
Connect For Mobile · Adobe
before 4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75686
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75686
Vendor Advisory
https://helpx.adobe.com/security/products/connect/apsb26-150.html
More from Adobe Connect
9.9
CVE-2026-75682
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
9.6
CVE-2026-34659
Adobe Connect | Deserialization of Untrusted Data (CWE-502)
9.6
CVE-2026-27303
Adobe Connect | Deserialization of Untrusted Data (CWE-502)
9.3
CVE-2026-75689
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
9.3
CVE-2026-75698
Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
