Critical Adobe Connect and AEM Forms Flaws Enable Code Execution

Adobe released security updates for 36 vulnerabilities across products including Adobe Connect, Adobe Experience Manager (AEM) Forms, Bridge, Content Credentials Rust SDK, C2PA Tool, InDesign, Premiere Pro, and Substance 3D Modeler. The fixes cover nine critical- and 17 high-severity issues, with impacts including arbitrary code execution, privilege escalation, security-feature bypass, information disclosure, and denial of service.

Adobe Connect fixes include critical SQL injection, cross-site scripting, and input-validation flaws affecting Android, macOS, and Windows; CVE-2026-75682 carries a CVSS score of 9.9 and could allow malicious code deployment and execution, while CVE-2026-75684 can enable privilege escalation. AEM Forms also received patches for critical authorization, input-validation, and server-side request forgery issues, including code-execution flaw CVE-2026-75745. Adobe reports no known in-the-wild exploitation, but advises customers to apply the updates and hotfixes; Connect and AEM Forms advisories are rated priority 2, calling for remediation within 30 days.