On September 22, 2026, Adobe published APSB26-150 for Connect. The bulletin lists nine vulnerabilities, including critical flaws that could enable code execution, privilege escalation or arbitrary file reads.
In its September 22 bulletin, Adobe says it is not aware of in-the-wild exploitation for the fixed flaws. The severity and the possible use of Connect for sensitive meetings still justify a prompt inventory and update.
What the bulletin covers
APSB26-150 covers nine CVEs: CVE-2026-75682 (SQL injection, CVSS 9.9); CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697 and CVE-2026-75698 (CVSS 9.3); CVE-2026-34689 (path traversal, CVSS 8.6); CVE-2026-83964 (CVSS 6.2); and CVE-2026-48361 (CVSS 6.1). Impacts and exploitation conditions differ by CVE.
Do not turn these impacts into a claim of confirmed compromise: they describe what a defect may allow within affected scope. Adobe's bulletin is the source of truth for technical and version details.
Versions to inventory
Adobe lists Connect 12.11 and earlier on Windows and macOS, plus Android mobile app 4.4 and earlier. The fixed versions are Connect 12.12 and Android 4.5.
Check relevant installations and presenter endpoints. If Adobe Connect is provided by a service provider, ask them to confirm that the fixed version has been applied; using a hosted service alone does not confirm its patch status.
Patch without losing evidence
Schedule the update, confirm the version after restart and test meeting, registration and administration flows. Preserve logs and version information before replacing an endpoint or image.
If remote administration is used, limit it to required networks and accounts during maintenance. Network controls reduce exposure but do not fix the flaw.
Accounts and meetings
After updating, review administrator accounts, role changes, new meeting hosts and unusual invitations. If a privileged account or deployment secret may have been readable, rotate it according to the evidence.
Tell training teams that an invitation or file sent after an alert could be a lure. The incident concerns a software surface, not automatically the content of every meeting.
The Soclyde connection
Soclyde does not patch Adobe Connect or monitor its meetings. It can help manage administration access and deployment secrets in an encrypted vault kept on your devices, without a central cloud vault operated by Soclyde.
That makes rotation easier without replacing the Adobe fix, session controls or IT logging.
Key takeaways
APSB26-150 fixes nine Adobe Connect flaws, with no known exploitation reported by Adobe at publication. Inventory versions, install fixed releases and review accounts. For secrets that need replacing, use the Soclyde password generator, read our secure password generator guide or contact Soclyde.
