EUVD-2026-84783
GHSA-fm9p-jgg9-6qqx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated (PR:L) network SQLi with full read/write/availability impact on the database; I assess S:U rather than S:C as impact stays within the vulnerable application's data boundary.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged authenticated Adobe Connect account (CVSS PR:L) with network reachability to the application; no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor CVSS is 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) for a CWE-89 SQL injection in Adobe Connect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed Adobe Connect release specified in the vendor bulletin APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html); the exact patched version number is not provided in the data for this analysis, so that bulletin is the authoritative source and should be consulted before declaring an instance remediated, and the corresponding updated Adobe Connect Android mobile app should be deployed to mobile users at the same time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Adobe Connect deployments (hosted, managed, or on-premises) and which Android mobile app installations are in use, verify whether Adobe has published a security bulletin or hotfix for CVE-2026-75682, and if none exists, convene the Connect service owner and identity team to inventory and prune dormant, guest, and over-privileged Connect accounts; enforce multi-factor authentication on all Connect logins and block or tightly restrict external/guest account creation until further notice. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allArbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today