Zaifliklar
Adobe, Veeam, Juniper Networks jiddiy zaifliklarni tuzatdi
Kamchiliklar ixtiyoriy kod bajarilishi, avtorizatsiya chetlab o‘tishi va imtiyozlar oshishiga olib kelishi mumkin.
Muallif
Ionut Arghire
| 29-oktabr, 2026 (ET bo‘yicha 9:42)
Adobe, Veeam va Juniper Networks o‘z mahsulotlari bo‘yicha o‘ttizdan ortiq zaiflikni, jumladan bir nechta jiddiy darajadagi kod bajarish kamchiliklarini tuzatish uchun yangilanishlar chiqardi.
Bu hafta Adobe Campaign Classic, Connect, Creative Cloud va Substance 3D Painter dasturlarida 12 ta zaiflikni tuzatdi.
Campaign Classic yangilanishi sakkizta jiddiy darajadagi xatoni, jumladan kod/buyruq in’eksiyasi, noto‘g‘ri avtorizatsiya va XSS muammolarini bartaraf etadi.
Muvaffaqiyatli foydalanish ixtiyoriy kod bajarilishi, xavfsizlik funksiyasini chetlab o‘tish va imtiyozlar oshishiga olib kelishi mumkin, deb ogohlantiradi Adobe 2-darajali ustuvorlik maslahatida.
Adobe Connect (ish stoli va mobil) dasturida ixtiyoriy kod bajarilishiga olib keladigan yana bir jiddiy darajadagi kamchilik ham tuzatildi.
Creative Cloud va Substance 3D Painter uchun xavfsizlik yangilanishlari kod bajarilishi, imtiyozlar oshishi va xotira sizib chiqishiga olib keladigan yuqori va o‘rta darajadagi xavfsizlik teshiklarini bartaraf etadi.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
Adobe bu zaifliklardan birortasi amalda foydalanilayotganidan xabardor emasligini aytadi.
Veeam Microsoft 365 uchun zaxira nusxasi, zaxira va qayta tiklash, Veeam ONE va Linux uchun Veeam Agent dasturlarida to‘qqizta xavfsizlik kamchiligini tuzatdi.
Microsoft 365 uchun zaxira nusxasida Veeam to‘rtta kamchilikni, jumladan hujumchilarga konfiguratsiya ma’lumotlarini ijarachi o‘rtasida o‘qish/yozish va masofadan kod bajarish imkonini berishi mumkin bo‘lgan jiddiy muammoni tuzatdi.
Shuningdek, u zaxira va qayta tiklash dasturida avtorizatsiya qilinmagan hujumchilarga avtorizatsiyani chetlab o‘tish imkonini berishi mumkin bo‘lgan jiddiy darajadagi xatoni ham bartaraf etdi.
Veeam yangilanishlari REST API avtorizatsiyasini chetlab o‘tish, ixtiyoriy faylni o‘qish yoki yozish, mahalliy imtiyozlar oshishi va ko‘p omilli autentifikatsiyani chetlab o‘tishga olib keladigan yuqori va o‘rta darajadagi zaifliklarni ham tuzatdi.
Kompaniya bu xavfsizlik kamchiliklaridan birortasi amalda foydalanilayotganini eslatib o‘tmaydi.
Juniper Networks Session Smart Router va Session Smart Conductor dasturlarida 18 ta zaiflikni, jumladan avtorizatsiya qilinmagan ixtiyoriy buyruq bajarilishi va imtiyozlar oshishiga olib keladigan ikkita jiddiy darajadagi kamchilikni tuzatdi.
Ixtiyoriy faylni o‘qish/yozish/o‘chirish, kod bajarilishi, imtiyozlar oshishi, buyruq bajarilishi, ma’lumot oshkor bo‘lishi va xizmatdan foydalanishni rad etish (DoS) ga olib keladigan yuqori darajadagi kamchiliklar ham bartaraf etildi.
Juniper Networks xatolarni ichki tekshiruv orqali aniqlagan va ularning birortasi amalda foydalanilayotganidan xabardor emas.
PHP2Shell zaifliklari haqidagi alohida maslahatda kompaniya CVE-2026-109618 Junos OS ga ta’sir qilishini, lekin foydalanish mumkin bo‘lmagan tarzda ekanligini qayd etdi. Shuningdek, u o‘nlab boshqa mahsulotni tekshirib, hech birida zaiflik yo‘qligini aniqladi.
Bog‘liq: Cisco SD-WAN nol kunlik zaifligi Volt Typhoon’ning “Jim Poyezd” tarmog‘iga bog‘langan
Bog‘liq: Avgustdan beri ikkinchi Cisco Firewall VPN nol kunlik zaifligi hujumchilari tomonidan foydalanilmoqda
Bog‘liq: Xitoylik xakerlar jiddiy bo‘lmagan ESXi jurnal xatosini nol kun sifatida jimgina ishlatishdi
Bog‘liq: Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So‘nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo‘lish uchun SecurityWeek elektron pochta byulleteniga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Ionut Arghiredan ko‘proq
- Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
- Xitoy bilan bog‘liq xakerlar PHP2Shell orqali firewallarni ildizdan buzishdi
- Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
- Sotuvchi kalitining sizib chiqishi 238 000 Denver Health Plan a’zolarining ma’lumotlarini xavf ostiga qo‘ydi
- HPE tarmoq mahsulotlarida o‘nlab jiddiy kamchiliklarni tuzatdi
- Tushunarsiz DreamHost hodisasi elektron pochta va FTP parollarini qayta o‘rnatishga majbur qildi
- O‘lik Popcorn Time yangilovchisi millionlab kompyuterlarni egallash xavfiga duchor qildi
- Genesys xakerligi ichki tizimlardan mijoz ma’lumotlarini o‘g‘irladi
So‘nggi yangiliklar
- BAE bankrot sudlari bilan bog‘liq hodisada ma’lumotlar chiqarilmaganini aytdi
- 41 000 dan ortiq DHS xodimlarining yozuvlari onlayn tarzda sizib chiqdi
- Xakerlar Sony’ning Yaponiya ISP So-net’idan 2,6 million yozuvni o‘g‘irlashdi
- Cisco SD-WAN nol kunlik zaifligi Volt Typhoon’ning “Jim Poyezd” tarmog‘iga bog‘langan
- Hujumchilar avgustdan beri ikkinchi Cisco Firewall VPN nol kunlik zaifligini ishlatishmoqda
- HHS arizasi iRhythm ma’lumotlar buzilishini 8,2 millionga yetkazdi
- Xitoylik xakerlar jiddiy bo‘lmagan ESXi jurnal xatosini nol kun sifatida jimgina ishlatishdi
- Ukraina Hive va Nefilim ransomware sherigi AQShda 70 oy qamoqqa hukm qilindi
Trendlar
Tailscale “Tailworm” kamchiliklarining muvofiqlashtirilmagan oshkor etilishidan so‘ng tezda tuzatishlarni shoshilinch tarzda chiqardi
Node2Shell: Brotli kamchiligi Microsoft, Node.js, Python paketlarida tuzatish to‘lqinini keltirib chiqardi
Xitoy bilan bog‘liq xakerlar PHP2Shell orqali firewallarni ildizdan buzishdi
CISA Node2Shell foydalanilishidan ogohlantiradi, chunki honeypotlar hujum urinishlarini qayd etmoqda
Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
iOS, macOS 27.2 286 ta xatoni tuzatdi; foydalanilayotgan kamchilikni tuzatish iOS 18 ga orqaga qaytarildi
Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
HPE tarmoq mahsulotlarida o‘nlab jiddiy kamchiliklarni tuzatdi
Kundalik axborot byulleteni
So‘nggi tahdidlar, tendensiyalar va texnologiyalar haqida xabardor bo‘lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta byulleteniga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Vebinar: Agentik pentestlash kuchliroq CTEM dasturi uchun
4-noyabr, 2026
Pentestlar orasidagi xavfsizlik bo‘shliqlarini yoping. Ushbu sessiyada agentik pentestlashni o‘rganing va CTEM dasturingizda uzluksiz ta’sirni tekshirish uchun amaliy asosga ega bo‘ling.
Ro‘yxatdan o‘ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11-noyabr, 2026
CISO’lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini bir joyga jamlaymiz, ular amaliy tajribani almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko‘rib chiqishadi.
Ro‘yxatdan o‘ting
Harakatdagi odamlar
Quantum eMotion Ueyn Tiplni CTO etib tayinladi.
Gay Ellis NCC Group bosh direktori etib tayinlandi.
Noma Security Bobbi Shokerni CFO va Alberto Rodrigesni CCO etib tayinladi.
Harakatdagi odamlar haqida ko‘proq
Mutaxassis fikrlari
Hech kim xavfsizlik so‘rovnomasiga ishonmaydi. Shunga qaramay, biz unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — jo‘natuvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o‘z-o‘zini baholash. Nihoyat, kompaniyalar o‘rtasida ishonch uchun yaxshiroq asos paydo bo‘ldi. (Sravish Sridhar)
Bu yaxshi: NetScaler nol kunlik zaifliklari yangi normal haqida nima deydi
Agar tez orada Citrix NetScaler yangilanishlarining yana bir to‘plami chiqarilsa, tuzatish quvurlarini tayyor saqlang. (Tod Bardsli)
Sun’iy intellekt dasturiy ta’minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz sun’iy intellektni qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir ko‘rsatadi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst shohdir
Kontekstual himoya xavfsizlik jamoalariga signallarni bog‘lash, keyingi qadamni oldindan bilish va tahdidlarni kuchayishidan oldin to‘xtatishga yordam beradi. (Etay Maor)
Sun’iy intellekt hujum tezligini o‘zgartirdi, xavfsizlik asoslarini emas
Sun’iy intellekt zaifliklarni aniqlash va ulardan foydalanishni tezlashtirgan sari, “virtual tuzatish” hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog‘liq. (Joshua Goldfarb)
Vulnerabilities
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.
By
Ionut Arghire
| October 29, 2026 (9:42 AM ET)
*
Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws.
This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter.
The Campaign Classic update resolves eight critical-severity bugs, including code/command injection, incorrect authorization, and XSS issues.
Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation, Adobe warns in a priority 2 advisory.
Another critical-severity defect leading to arbitrary code execution was addressed in Adobe Connect for desktop and mobile.
The security updates for Creative Cloud and Substance 3D Painter resolve high- and medium-severity security holes leading to code execution, privilege escalation, and memory leaks.
Advertisement. Scroll to continue reading.
Adobe says it is not aware of any of these vulnerabilities being exploited in the wild.
Veeam rolled out fixes for nine security defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux.
In Backup for Microsoft 365, Veeam fixed four flaws, including a critical issue that could have allowed attackers to read/write configuration data cross-tenant and achieve remote code execution.
It also resolved a critical-severity bug in Backup & Replication that could have allowed unauthenticated attackers to bypass authorization.
Veeam’s updates also resolved high- and medium-severity weaknesses leading to REST API authentication bypass, arbitrary file read or write, local privilege escalation, and multi-factor authentication bypass.
The company makes no mention of any of these security defects being exploited in the wild.
Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, including two critical-severity flaws leading to unauthenticated arbitrary command execution and privilege escalation.
High-severity flaws leading to arbitrary file read/write/deletion, code execution, privilege escalation, command execution, information disclosure, and denial-of-service (DoS) were also resolved.
Juniper Networks discovered the bugs internally and is not aware of any of them being exploited in the wild.
In a separate advisory covering the PHP2Shell vulnerabilities, the company noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. It also investigated roughly a dozen other products and found none to be vulnerable.
Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
- HPE Patches Dozens of Critical Flaws in Networking Products
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Genesys Hack Exposes Customer Data From Internal Systems
Latest News
- BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
- Over 41,000 DHS Employee Records Leaked Online
- Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Trending
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Hackers Start Probing Fresh Oracle EBS Vulnerability
HPE Patches Dozens of Critical Flaws in Networking Products
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)