Adobe claudit critica vulnera in Connect et AEM Forms

Adobe emisit updates securitatis pro criticis vulneribus in Adobe Connect et Adobe Experience Manager (AEM) Forms. Diversa vulnera securitatis permittunt ut codex arbitrarius exsequi vel iura elevata obtinere. Adobe dicit nullas indicia habere quod vulnera active abutantur.

In Adobe Connect plura critica problemata securitatis correpta sunt. Gravissimum vulnus, CVE-2026-75682, habet CVSS punctationem 9.9 in scala 10 et pertinet ad SQL-injection. Invasor cum iuribus limitatis potest hanc vulnerabilitatem a remoto abuti sine interactione usoris. Successiva exploitatio potest ducere ad exsecutionem codicis arbitrarii.

Adobe etiam plura critica vulnera in Connect corrigit quae ex cross-site scripting (XSS) et invalidi input validatione oriuntur. Haec vulnera inter alia possunt ducere ad privilegii escalationem et exsecutionem codicis. Pro parte harum vulnerum interactio usoris requiritur.

Connect 12.11 et versiones anteriores vulnerabiles sunt. Adobe suadet usoribus ut ad versionem 12.12 upgradeant. Etiam Android-app Adobe Connect securitatis problemata continet. Usoribus versionis 4.4 et antiquioris suadetur ut ad versionem 4.5 upgradeant.

AEM Forms

Etiam Adobe Experience Manager Forms in Java Enterprise Edition (JEE) varias criticas vulnera continet. Gravissimum vulnus, CVE-2026-75745, habet CVSS punctationem 9.8. Problemata ex invalidi authorizatione oriuntur et a non authentico invasore a remoto abuti possunt ad exsecutionem codicis arbitrarii.

Alia vulnera in AEM Forms etiam possunt ducere ad exsecutionem codicis, privilegii escalationem et circumventionem mensurarum securitatis. Inter haec sunt insufficientes input validationes et server-side request forgery (SSRF).

AEM 6.5 LTS Forms Service Pack 2 et antiquiores et AEM 6.5 Forms 6.5.25 et antiquiores affectae sunt. Pro versione LTS Adobe Service Pack 3 praebuit. Pro AEM 6.5 Forms hotfix emissa est.

Vulnerabilitates Relatae

CVE-2026-75745 CVSS 10 CRITICAL Awaiting Analysis

CVE-2026-75745 - Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-75682 CVSS 9.9 CRITICAL Analyzed

CVE-2026-75682 - Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe claudit critica vulnera in Connect et AEM Forms

Vulnerabilitates Relatae

Plura ex security.nl