Adobe Security Updates - September 2026
Roundup of Adobe security advisories published in September 2026.
CVE search metadata
CVE search record: CVE-2026-83959. Severity: high. CVSS: 7.8. EPSS: 0.17%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75650. Severity: critical. CVSS: 10.0. EPSS: 2.15%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-76200. Severity: critical. CVSS: 9.3. EPSS: 0.46%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-76201. Severity: critical. CVSS: 9.3. EPSS: 0.46%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82004. Severity: critical. CVSS: 10.0. EPSS: 1.44%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-19232. Severity: critical. CVSS: 9.9. EPSS: 0.57%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-48273. Severity: critical. CVSS: 9.9. EPSS: 1.90%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75746. Severity: critical. CVSS: 9.1. EPSS: 1.07%. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-73369. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75699. Severity: critical. CVSS: 10.0. KEV: no. Product: Campaign Classic. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75703. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75721. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75723. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75728. Severity: critical. CVSS: 9.1. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82008. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82009. Severity: critical. CVSS: 9.1. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82010. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82011. Severity: critical. CVSS: 9.1. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82013. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-82443. Severity: critical. CVSS: 9.6. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-83660. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-84412. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-89275. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
CVE search record: CVE-2026-75682. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - September 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/
What's new
This roundup covers 36 Adobe security vulnerabilities. CVSS base scores range from 7.8 to 10.0. None are reported as actively exploited at the time of release. The issues affect Adobe Commerce, Adobe Connect, Bridge, Campaign Classic, ColdFusion, Commerce, Connect, Experience Manager, Experience Manager Forms JEE, Substance 3D Modeler, Substance 3D Sampler.
Summary
| CVE | Product | Severity | CVSS | EPSS | KEV | Source |
|---|---|---|---|---|---|---|
| CVE-2026-83959 | Substance 3D Sampler | High | 7.8 | 0.17% | no | NVD (authoritative) |
| CVE-2026-75650 | Adobe Commerce | Critical | 10.0 | 2.15% | no | NVD (authoritative) |
| CVE-2026-76200 | Commerce | Critical | 9.3 | 0.46% | no | NVD (authoritative) |
| CVE-2026-76201 | Commerce | Critical | 9.3 | 0.46% | no | NVD (authoritative) |
| CVE-2026-82004 | Campaign Classic | Critical | 10.0 | 1.44% | no | NVD (authoritative) |
| CVE-2026-19232 | Experience Manager | Critical | 9.9 | 0.57% | no | NVD (authoritative) |
| CVE-2026-48273 | ColdFusion | Critical | 9.9 | 1.90% | no | NVD (authoritative) |
| CVE-2026-75746 | ColdFusion | Critical | 9.1 | 1.07% | no | NVD (authoritative) |
| CVE-2026-73369 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-75699 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-75703 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-75721 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-75723 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-75728 | Campaign Classic | Critical | 9.1 | no | NVD (authoritative) | |
| CVE-2026-82008 | Campaign Classic | no | NVD (authoritative) | |||
| CVE-2026-82009 | Campaign Classic | Critical | 9.1 | no | NVD (authoritative) | |
| CVE-2026-82010 | Campaign Classic | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-82011 | Campaign Classic | Critical | 9.1 | no | NVD (authoritative) | |
| CVE-2026-82013 | Campaign Classic | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-82443 | Campaign Classic | Critical | 9.6 | no | NVD (authoritative) | |
| CVE-2026-83660 | Campaign Classic | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-84412 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-89275 | Campaign Classic | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-89276 | Campaign Classic | no | NVD (authoritative) | |||
| CVE-2026-82003 | Campaign Classic | no | NVD (authoritative) | |||
| CVE-2026-75682 | Connect | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-75684 | Connect | no | NVD (authoritative) | |||
| CVE-2026-75689 | Connect | no | NVD (authoritative) | |||
| CVE-2026-75698 | Adobe Connect | no | NVD (authoritative) | |||
| CVE-2026-75745 | Experience Manager Forms JEE | no | NVD (authoritative) | |||
| CVE-2026-81995 | Experience Manager Forms JEE | no | NVD (authoritative) | |||
| CVE-2026-82000 | Experience Manager Forms JEE | no | NVD (authoritative) | |||
| CVE-2026-34689 | Connect | no | NVD (authoritative) | |||
| CVE-2026-75649 | Bridge | no | NVD (authoritative) | |||
| CVE-2026-75743 | Experience Manager Forms JEE | no | NVD (authoritative) | |||
| CVE-2026-81998 | Substance 3D Modeler | no | NVD (authoritative) |
CVE-2026-83959
Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability triggered by opening a malicious file. Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the current user, requiring user interaction to open the crafted file.
Affected products:
- Substance 3D Sampler
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83959
CVE-2026-75650
Adobe Commerce contains a vulnerability involving improper neutralization of special elements used in a template engine, which allows an unauthenticated attacker to execute arbitrary code. The vulnerability is categorized as remote code execution, does not require user interaction, and impacts the integrity and availability of the system.
Affected products:
- Adobe Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75650
CVE-2026-76200
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes within the victim's session, potentially leading to unauthorized account access or session hijacking.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76200
Related in this roundup: CVE-2026-76201.
CVE-2026-76201
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing an attacker to inject malicious scripts into form fields. When a victim accesses the affected page, the script executes in their browser, potentially leading to session hijacking or unauthorized account access.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76201
Related in this roundup: CVE-2026-76200.
CVE-2026-82004
Adobe Campaign Classic (ACC) is vulnerable to an OS command injection flaw (CVE-2026-82004) that allows unauthenticated attackers to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability has a CVSS v3.1 base score of 10.0 and involves a changed scope, indicating potential impact beyond the affected service.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82004
Related in this roundup: CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-19232
Adobe Experience Manager is vulnerable to an incorrect authorization flaw that allows a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and can result in the attacker gaining elevated access or control over a victim's session, leading to a full compromise of the affected account scope.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-19232
CVE-2026-48273
Adobe ColdFusion is vulnerable to an improper neutralization of directives in dynamically evaluated code (Eval Injection), which allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, significantly increasing the impact of successful exploitation.
Affected products:
- ColdFusion
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48273
Related in this roundup: CVE-2026-75746.
CVE-2026-75746
Adobe ColdFusion is vulnerable to a high-severity SQL injection flaw (CVE-2026-75746) that allows a highly privileged attacker to achieve remote code execution. The vulnerability does not require user interaction and impacts the integrity and availability of the application environment.
Affected products:
- ColdFusion
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75746
Related in this roundup: CVE-2026-48273.
CVE-2026-73369
Adobe Campaign Classic (ACC) is vulnerable to a code injection vulnerability (CVE-2026-73369) that allows for remote code execution in the context of the current user. The vulnerability does not require user interaction for exploitation and is classified as having a CVSS v3.1 base score of 10.0.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-73369
Related in this roundup: CVE-2026-82004, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-75699
Adobe Campaign Classic (ACC) contains a code injection vulnerability that allows an unauthenticated attacker to execute arbitrary code with the privileges of the application user. This issue is categorized as a critical risk with a CVSS score of 10.0, as it does not require user interaction and impacts the overall system integrity and confidentiality.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75699
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-75703
CVE-2026-75703 identifies an improper control of generation of code vulnerability in Adobe Campaign Classic (ACC). The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user without requiring user interaction. The impact includes a full compromise of the service integrity and availability (CVSS 10.0), necessitating immediate patching.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75703
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-75721
Adobe Campaign Classic is vulnerable to an Improper Control of Generation of Code ('Code Injection') vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code within the context of the application user. The vulnerability carries a CVSS base score of 10.0 and does not require user interaction to exploit.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75721
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-75723
Adobe Campaign Classic (ACC) is vulnerable to an incorrect authorization flaw that allows an attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the system scope, presenting a high risk for potential exploitation.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75723
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-75728
Adobe Campaign Classic (ACC) contains an incorrect authorization vulnerability that allows an unauthenticated attacker to achieve arbitrary code execution. The vulnerability does not require user interaction, making it a critical risk for deployments of the affected software.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75728
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82008
Adobe Campaign Classic (ACC) is vulnerable to an improper input validation flaw that allows a low-privileged attacker to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability is considered high severity due to the potential for arbitrary code execution.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82008
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82009
Adobe Campaign Classic (ACC) is vulnerable to a high-severity SQL injection flaw (CVE-2026-82009) that allows authenticated attackers with high privileges to execute arbitrary SQL commands. Successful exploitation can lead to arbitrary code execution within the context of the current user without requiring user interaction.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82009
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82010
Adobe Campaign Classic (ACC) contains an SQL injection vulnerability that can be exploited by a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the overall scope of the target application.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82010
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82011
Adobe Campaign Classic is vulnerable to an SQL injection vulnerability that allows low-privileged attackers to bypass security measures, resulting in unauthorized read and limited write access to the application data. The vulnerability does not require user interaction and impacts the overall security scope of the affected system.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82011
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82013
Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that allows low-privileged, unauthenticated attackers to perform privilege escalation. An attacker can leverage this vulnerability to gain unauthorized access to internal resources, with the exploit not requiring user interaction.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82013
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-82443
Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that allows a low-privileged attacker to achieve privilege escalation. The vulnerability is exploitable remotely without user interaction and results in a change of security scope, potentially granting the attacker unauthorized access to internal resources.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82443
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-83660
Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that can be exploited by a remote attacker without user interaction to achieve privilege escalation. Due to the changed scope of the vulnerability and the high CVSS score, it represents a significant risk to the integrity and authorization controls of the Campaign Classic environment.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83660
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-84412
Adobe Campaign Classic (ACC) is susceptible to a code injection vulnerability that allows an unauthenticated remote attacker to execute arbitrary code within the context of the current user. The vulnerability does not require user interaction and involves a change in scope, carrying a CVSS base score of 10.0.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-84412
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-89275, CVE-2026-89276, CVE-2026-82003.
CVE-2026-89275
Adobe Campaign Classic (ACC) is vulnerable to a code injection vulnerability, classified as CVE-2026-89275, which allows an unauthenticated attacker to achieve remote code execution in the context of the current user. The vulnerability does not require user interaction and involves a change in scope, carrying a CVSS v3.1 base score of 10.0.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89275
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89276, CVE-2026-82003.
CVE-2026-89276
CVE-2026-89276 is a critical code injection vulnerability in Adobe Campaign Classic that allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, and successful exploitation grants the attacker the execution privileges of the current user context.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89276
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-82003.
CVE-2026-82003
Adobe Campaign Classic (ACC) contains an improper input validation vulnerability that can be exploited by a low-privileged, unauthenticated attacker to achieve arbitrary code execution. The vulnerability does not require user interaction, though successful exploitation is dependent on specific environmental conditions.
Affected products:
- Campaign Classic
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82003
Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.
CVE-2026-75682
Adobe Connect is vulnerable to an SQL injection vulnerability (CVE-2026-75682) that allows a low-privileged attacker to execute arbitrary SQL commands. Successful exploitation can lead to arbitrary code execution, session hijacking, or privilege escalation without requiring user interaction.
Affected products:
- Connect
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75682
Related in this roundup: CVE-2026-75684, CVE-2026-75689, CVE-2026-34689.
CVE-2026-75684
Adobe Connect is vulnerable to a stored Cross-Site Scripting (XSS) attack via improper sanitization of user-supplied input in form fields. An attacker can inject malicious JavaScript that executes in the context of a victim's browser session, potentially allowing for account takeover or session hijacking.
Affected products:
- Connect
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75684
Related in this roundup: CVE-2026-75682, CVE-2026-75689, CVE-2026-34689.
CVE-2026-75689
Adobe Connect is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes in their browser context, potentially leading to unauthorized account or session control.
Affected products:
- Connect
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75689
Related in this roundup: CVE-2026-75682, CVE-2026-75684, CVE-2026-34689.
CVE-2026-75698
Adobe Connect is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute malicious scripts within a user's browser session by tricking them into interacting with a crafted URL or compromised webpage. This vulnerability could lead to unauthorized account access or session hijacking.
Affected products:
- Adobe Connect
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75698
CVE-2026-75745
Adobe Experience Manager Forms JEE is vulnerable to an incorrect authorization flaw, allowing a remote, unauthenticated attacker to execute arbitrary code within the context of the current user. The vulnerability has a CVSS base score of 10.0 and allows for remote exploitation without user interaction.
Affected products:
- Experience Manager Forms JEE
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75745
Related in this roundup: CVE-2026-81995, CVE-2026-82000, CVE-2026-75743.
CVE-2026-81995
Adobe Experience Manager Forms JEE contains an improper input validation vulnerability (CVE-2026-81995) that allows a highly privileged attacker to achieve remote code execution without user interaction. The vulnerability has a CVSS v3.1 base score of 9.1 and results in a scope change, indicating significant impact on the affected system.
Affected products:
- Experience Manager Forms JEE
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-81995
Related in this roundup: CVE-2026-75745, CVE-2026-82000, CVE-2026-75743.
CVE-2026-82000
Adobe Experience Manager Forms JEE is vulnerable to a Server-Side Request Forgery (SSRF) flaw, identified as CVE-2026-82000, which allows a low-privileged attacker to achieve privilege escalation. The vulnerability can be exploited without user interaction and results in a change of scope, potentially granting unauthorized access to internal resources.
Affected products:
- Experience Manager Forms JEE
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82000
Related in this roundup: CVE-2026-75745, CVE-2026-81995, CVE-2026-75743.
CVE-2026-34689
Adobe Connect is vulnerable to a path traversal vulnerability (CVE-2026-34689) that allows unauthenticated remote attackers to perform arbitrary file system reads. The vulnerability does not require user interaction and impacts the scope of the application, potentially exposing sensitive system or application files.
Affected products:
- Connect
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-34689
Related in this roundup: CVE-2026-75682, CVE-2026-75684, CVE-2026-75689.
CVE-2026-75649
Adobe Bridge is vulnerable to a heap-based buffer overflow triggered by opening a specially crafted malicious file, which allows an attacker to achieve arbitrary code execution under the context of the currently logged-in user.
Affected products:
- Bridge
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75649
CVE-2026-75743
Adobe Experience Manager Forms JEE is vulnerable to a Cross-Site Request Forgery (CSRF) flaw that allows an attacker to bypass security controls and gain unauthorized write access. Exploitation requires user interaction via a malicious URL or web page, potentially leading to limited disruption of service.
Affected products:
- Experience Manager Forms JEE
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75743
Related in this roundup: CVE-2026-75745, CVE-2026-81995, CVE-2026-82000.
CVE-2026-81998
Adobe Substance 3D Modeler is vulnerable to an out-of-bounds write flaw that can be triggered by convincing a user to open a specially crafted malicious file. Successful exploitation allows for arbitrary code execution in the context of the current user, requiring active user interaction.
Affected products:
- Substance 3D Modeler