Vulnerabilities
Adobe Releases Patches for Nine Critical Connect Flaws and Six AEM Forms Vulnerabilities
Adobe has issued updates that fix nine critical defects in Adobe Connect and six critical flaws in AEM Forms, all capable of enabling arbitrary code execution or privilege escalation. The patches address SQL injection, XSS, SSRF, and path traversal issues. Defenders should apply the updates immediately and verify affected versions.
What Happened
Adobe rolled out a security update on Tuesday that addresses 36 vulnerabilities across its product line, including nine critical defects in Adobe Connect and six critical flaws in Adobe Experience Manager (AEM) Forms.
Impact
All nine Connect vulnerabilities (CVE‑2026‑75682, ‑75684, ‑75686, ‑75689, ‑75697, ‑75698) could allow an attacker to inject SQL, inject cross‑site scripting, or bypass input validation to execute arbitrary code or elevate privileges. The six AEM Forms defects (CVE‑2026‑75745, ‑81995, and three others) involve incorrect authorization, SSRF, and improper input validation, also leading to code execution and privilege escalation.
Affected Versions
Adobe Connect versions prior to 2026‑09‑22 and AEM Forms versions before the 2026‑09‑23 release are vulnerable. The patch is available for all supported platforms.
Mitigation Steps
- Download and install the latest Adobe Connect and AEM Forms patches from the Adobe Security Bulletin.
- Verify the installed version numbers match the patched releases.
- Review application logs for any suspicious activity that could indicate exploitation attempts.
- Implement network segmentation and web‑application firewall rules to block known attack vectors such as SQL injection and SSRF.
- Maintain an inventory of all Adobe products and schedule regular vulnerability scans.
Related vulnerabilities
Multiple RCE, Data Breach, and DoS Vulnerabilities in F5 NGINX Products
F5 has disclosed multiple critical vulnerabilities affecting its NGINX-based products, including remote code execution, data confidentiality and integrity compromise, and denial‑of‑service. Affected versions span F5 DoS for NGINX 4.x <4.11.0, F5 WAF for NGINX 5.x <5.16.0, and several other NGINX components. Defenders should verify product versions, apply vendor patches, and monitor for anomalous activity.
Read briefing
Mozilla Products Hit by 20+ Critical Vulnerabilities
The French CERT released an alert on September 16, 2026, detailing a suite of 22 CVEs affecting older releases of Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The flaws enable attackers to elevate privileges, launch remote denial‑of‑service attacks, and exfiltrate sensitive data. Patches are available through Mozilla’s MFSA 2026‑90 to 2026‑95 advisories. All affected users should update immediately.
Read briefing
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing
CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog
CISA has added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to its Known Exploited Vulnerabilities catalog. The additions underscore the need for rapid patching of publicly exposed assets that could grant full control. Defenders should verify patch status and monitor for exploitation indicators.
Read briefing