Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws.

This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter.

The Campaign Classic update resolves eight critical-severity bugs, including code/command injection, incorrect authorization, and XSS issues.

Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation, Adobe warns in a priority 2 advisory.

Another critical-severity defect leading to arbitrary code execution was addressed in Adobe Connect for desktop and mobile.

The security updates for Creative Cloud and Substance 3D Painter resolve high- and medium-severity security holes leading to code execution, privilege escalation, and memory leaks.

Adobe says it is not aware of any of these vulnerabilities being exploited in the wild.

Veeam rolled out fixes for nine security defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux.

In Backup for Microsoft 365, Veeam fixed four flaws, including a critical issue that could have allowed attackers to read/write configuration data cross-tenant and achieve remote code execution.

It also resolved a critical-severity bug in Backup & Replication that could have allowed unauthenticated attackers to bypass authorization.

Veeam’s updates also resolved high- and medium-severity weaknesses leading to REST API authentication bypass, arbitrary file read or write, local privilege escalation, and multi-factor authentication bypass.

The company makes no mention of any of these security defects being exploited in the wild.

Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, including two critical-severity flaws leading to unauthenticated arbitrary command execution and privilege escalation.

High-severity flaws leading to arbitrary file read/write/deletion, code execution, privilege escalation, command execution, information disclosure, and denial-of-service (DoS) were also resolved.

Juniper Networks discovered the bugs internally and is not aware of any of them being exploited in the wild.

In a separate advisory covering the PHP2Shell vulnerabilities, the company noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. It also investigated roughly a dozen other products and found none to be vulnerable.

Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Hackers Start Probing Fresh Oracle EBS Vulnerability

Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

HPE Patches Dozens of Critical Flaws in Networking Products

Unexplained DreamHost Incident Prompts Email, FTP Password Resets

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Genesys Hack Exposes Customer Data From Internal Systems

BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts

Over 41,000 DHS Employee Records Leaked Online

Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Flipboard Whatsapp Whatsapp Email