Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws.

This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter.

The Campaign Classic update resolves eight critical-severity bugs, including code/command injection, incorrect authorization, and XSS issues.

Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation, Adobe warns in a priority 2 advisory.

Another critical-severity defect leading to arbitrary code execution was addressed in Adobe Connect for desktop and mobile.

The security updates for Creative Cloud and Substance 3D Painter resolve high- and medium-severity security holes leading to code execution, privilege escalation, and memory leaks.

Adobe says it is not aware of any of these vulnerabilities being exploited in the wild.

Veeam rolled out fixes for nine security defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux.

In Backup for Microsoft 365, Veeam fixed four flaws, including a critical issue that could have allowed attackers to read/write configuration data cross-tenant and achieve remote code execution.

It also resolved a critical-severity bug in Backup & Replication that could have allowed unauthenticated attackers to bypass authorization.

Veeam’s updates also resolved high- and medium-severity weaknesses leading to REST API authentication bypass, arbitrary file read or write, local privilege escalation, and multi-factor authentication bypass.

The company makes no mention of any of these security defects being exploited in the wild.

Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, including two critical-severity flaws leading to unauthenticated arbitrary command execution and privilege escalation.

High-severity flaws leading to arbitrary file read/write/deletion, code execution, privilege escalation, command execution, information disclosure, and denial-of-service (DoS) were also resolved.

Juniper Networks discovered the bugs internally and is not aware of any of them being exploited in the wild.

In a separate advisory covering the PHP2Shell vulnerabilities, the company noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. It also investigated roughly a dozen other products and found none to be vulnerable.

Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.

Hackers Start Probing Fresh Oracle EBS Vulnerability

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.