Adobe Patches 25 Vulnerabilities: Critical Flaws in Connect and AEM Forms Disclosed Together
Adobe released patches for 25 vulnerabilities on September 22, 2026, including critical flaws in Adobe Connect and AEM Forms, impacting multiple products.
Key findings
- Adobe patched 25 vulnerabilities on September 22, 2026, across products including Connect, AEM Forms, Substance3D, and Bridge.
- Critical flaws in Adobe Connect (CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698) allow arbitrary code execution and privilege escalation.
- AEM Forms JEE is affected by critical SSRF, SQL injection, and XSS vulnerabilities (CVE-2026-75745, CVE-2026-82000, CVE-2026-81995).
- Substance3D Modeler and Bridge face high-severity buffer overflow and out-of-bounds write vulnerabilities requiring malicious file interaction.
- The batch includes denial-of-service, security bypass, and memory disclosure vulnerabilities in CAI Content Credentials and InDesign Desktop.
On September 22, 2026, Adobe released a significant security update addressing 25 vulnerabilities across multiple products, including Adobe Connect, Experience Manager (AEM) Forms, Substance3D Modeler, Bridge, CAI Content Credentials, and InDesign Desktop. The batch includes critical and high-severity flaws, with several allowing for arbitrary code execution and privilege escalation.
Several vulnerabilities were identified in Adobe Connect, with six critical flaws (CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698) carrying a CVSSv3 score of 9.3. These include stored and reflected cross-site scripting (XSS) vulnerabilities, improper input validation leading to arbitrary code execution, and a critical SQL injection flaw (CVE-2026-75682) that could allow for arbitrary SQL command execution. Additionally, CVE-2026-75698 is a reflected XSS vulnerability, while CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, and CVE-2026-75697 are stored XSS vulnerabilities. CVE-2026-75686 specifically involves improper input validation leading to arbitrary code execution.
Adobe Experience Manager (AEM) Forms JEE was also heavily impacted, with critical vulnerabilities such as CVE-2026-75745 (Incorrect Authorization leading to arbitrary code execution) and CVE-2026-82000 (SSRF leading to privilege escalation). Other high and critical severity flaws in AEM Forms include CVE-2026-81995 (Improper Input Validation for arbitrary code execution), CVE-2026-81999 (SSRF for privilege escalation), and CVE-2026-75744 (stored XSS). A CSRF vulnerability, CVE-2026-75743, could lead to a security feature bypass.
The Substance3D Modeler product is affected by multiple out-of-bounds write and stack-based buffer overflow vulnerabilities (CVE-2026-83963, CVE-2026-83962, CVE-2026-81998, CVE-2026-79906), all carrying a high severity rating and the potential for arbitrary code execution upon opening a malicious file. Similarly, Adobe Bridge has high-severity stack-based and heap-based buffer overflow vulnerabilities (CVE-2026-75676, CVE-2026-75665) and an out-of-bounds write vulnerability (CVE-2026-75663), all requiring user interaction through opening a malicious file.
Other affected products include CAI Content Credentials, which has an integer overflow or wraparound vulnerability (CVE-2026-89277) leading to denial-of-service, and an improper input validation vulnerability (CVE-2026-76194) for security feature bypass. InDesign Desktop is impacted by NULL Pointer Dereference vulnerabilities (CVE-2026-84396, CVE-2026-76192) causing denial-of-service. Adobe Connect also has an improper certificate validation vulnerability (CVE-2026-83964) leading to disclosure of sensitive memory.
According to SecurityWeek, Adobe patched a total of 36 vulnerabilities across its products in this release, with a particular focus on critical flaws in Connect and AEM Forms. The vulnerabilities patched in Adobe Connect, including SQL injection, XSS, and improper input validation, could be exploited for arbitrary code execution and privilege escalation.
Users are strongly advised to update their Adobe products to the latest versions to mitigate these risks. The full list of affected products and specific version information can be found in Adobe's official security advisories.
This coordinated disclosure highlights the importance of timely patching for Adobe's diverse product ecosystem. The range of vulnerabilities, from denial-of-service to arbitrary code execution, underscores the need for continuous vigilance and prompt security updates for users of these applications.