Adobe released security updates for Adobe Connect and Adobe Experience Manager (AEM) Forms that fix multiple critical flaws affecting organizations that run those products. In Connect, six critical bugs tracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698 involve SQL injection, cross-site scripting, and input-validation issues that could enable remote code execution or privilege escalation. In AEM Forms, critical flaws CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000 involve authorization, input validation, and server-side request forgery. Adobe says it has no evidence of active exploitation and rated the updates Priority 2.
Why it matters: Organizations using Adobe Connect or AEM Forms should plan prompt patching because these are critical server-side flaws that could let attackers take over systems or gain broader access. Even without reported active exploitation, internet-facing collaboration and form-processing servers are attractive targets and should be updated within Adobe’s recommended window.
Ionut Arghire
2026.09.23
100% relevant
This article establishes a distinct September 2026 Adobe patch event focused on newly disclosed critical flaws in Connect and AEM Forms, separate from previously tracked Adobe stories about other products such as ColdFusion, Campaign Classic, Acrobat, and broader monthly patch batches.
← Back to all stories