Adobe patched nine critical security defects in Adobe Connect, including SQL injection, cross-site scripting (XSS), and improper input validation flaws that could lead to arbitrary code execution and privilege escalation. Six vulnerabilities in AEM Forms were also fixed, including critical issues involving incorrect authorization, improper input validation, and server-side request forgery (SSRF), which could result in code execution and privilege escalation. Additional high-severity issues such as path traversal, improper certificate validation, and cross-site request forgery (CSRF) were addressed. The updates cover multiple CVEs including CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698, CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000. Adobe has assigned a priority 2 rating to these patches and advises applying them within 30 days. There are no reports of exploitation in the wild.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code and escalate privileges within affected Adobe Connect and AEM Forms environments. This could compromise system integrity and confidentiality. Other impacts include potential security feature bypass, arbitrary file system read, and denial-of-service conditions. However, Adobe has not observed any active exploitation of these flaws in the wild.

Adobe has released official patches addressing these critical vulnerabilities. Users should apply the provided updates for Adobe Connect and AEM Forms within 30 days as per Adobe's priority 2 rating. There is no indication that additional mitigations are required beyond applying these patches.