Adobe Connect 12.12 patches 9.9-severity SQL injection that enables code execution

Adobe's September 2026 security bulletin for Adobe Connect ships fixes for nine vulnerabilities, and one of them stands out: CVE-2026-75682, a SQL injection scored 9.9 on the CVSS scale that Adobe says can result in arbitrary code execution. According to a dev.to analysis of bulletin APSB26-150, the release covers both the Connect server and the Connect Android mobile app, with version 12.12 and version 4.5 as the patched builds. Adobe reports no evidence that any of the nine flaws are being exploited in the wild.

What makes the SQL injection the headline issue

The critical detail in CVE-2026-75682 is the gap between what an attacker needs and what they get. Exploitation requires only a low-privileged account on the system, not administrative access. The payoff, per Adobe's description relayed by dev.to, is arbitrary code execution rather than mere database access.

That combination changes the calculus. A SQL injection that stops at data exposure is an information disclosure problem; one that ends in code execution hands the attacker control of a server component. And unlike the cross-site scripting bugs in the same bulletin, this flaw carries no user-interaction requirement in Adobe's summary, so no victim has to click anything for it to fire.

The other eight CVEs

Seven of the nine flaws are rated critical, and six of those score 9.3 or higher under CVSS v3, dev.to reports. Grouped by weakness class:

• Stored cross-site scripting leading to privilege escalation: CVE-2026-75684, CVE-2026-75689 and CVE-2026-75697. These need no authentication, but a victim must interact with malicious content.
• Improper input validation and reflected cross-site scripting: CVE-2026-75686 and CVE-2026-75698, also interaction-dependent.
• Path traversal: CVE-2026-34689, rated 8.6. This one needs neither authentication nor user interaction, making it the easiest flaw in the batch to probe remotely.
• Two lower-severity issues, CVE-2026-83964 and CVE-2026-48361, which the summary does not detail.

Who should act, and how fast

Any on-premises or managed Adobe Connect deployment below 12.12 remains exposed, as do Android clients below 4.5. The dev.to write-up highlights three deployment patterns worth checking first: Connect servers reachable from the internet by external students, partners or customers; internal instances accessible from VPN ranges or third-party support networks; and mobile apps that talk to a patched server but still run an older build.

For scale, a ZoomEye query for Adobe Connect fingerprints returned 23,660 instances at the time of writing. That figure counts indexed product signatures, not confirmed vulnerable hosts, but it signals that the product's internet-facing population is substantial.

Patch ordering and compensating controls

The dev.to article suggests a defensible sequence when one maintenance window cannot cover everything: fix the code-execution flaw first, then the unauthenticated path traversal, then the interaction-dependent XSS issues, then the remainder. Practical steps include:

• Upgrade the server to 12.12 and the Android app to 4.5.
• Verify patch levels from the application itself rather than relying on change records.
• Restrict administrative and management interfaces to trusted networks while the upgrade is under way.
• Audit accounts with meeting-hosting or content-upload rights, since the SQL injection only needs a low-privileged starting point.

Where immediate patching is not possible, the fallback is conventional damage limitation: shrink the service's exposure, keep it segmented from identity infrastructure, and monitor the host for unusual outbound connections.

Why it matters

A 9.9-rated SQL injection that converts a low-privileged account into code execution is the kind of flaw that justifies pulling a patch forward rather than waiting for a scheduled window, especially on servers that external users can reach. The Dutch national cyber security centre has published its own advisory, NCSC-2026-0391, which dev.to cites alongside Adobe's bulletin, underscoring that national CERTs are tracking the release. With tens of thousands of Connect instances fingerprinted online and a straightforward upgrade path available, the risk is not the complexity of the fix — it is how long deployments stay unpatched.