Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

By

Ionut Arghire

| October 29, 2026 (9:42 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws.

This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter.

The Campaign Classic update resolves eight critical-severity bugs, including code/command injection, incorrect authorization, and XSS issues.

Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation, Adobe warns in a priority 2 advisory.

Another critical-severity defect leading to arbitrary code execution was addressed in Adobe Connect for desktop and mobile.

The security updates for Creative Cloud and Substance 3D Painter resolve high- and medium-severity security holes leading to code execution, privilege escalation, and memory leaks.

Advertisement. Scroll to continue reading.

Adobe says it is not aware of any of these vulnerabilities being exploited in the wild.

Veeam rolled out fixes for nine security defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux.

In Backup for Microsoft 365, Veeam fixed four flaws, including a critical issue that could have allowed attackers to read/write configuration data cross-tenant and achieve remote code execution.

It also resolved a critical-severity bug in Backup & Replication that could have allowed unauthenticated attackers to bypass authorization.

Veeam’s updates also resolved high- and medium-severity weaknesses leading to REST API authentication bypass, arbitrary file read or write, local privilege escalation, and multi-factor authentication bypass.

The company makes no mention of any of these security defects being exploited in the wild.

Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, including two critical-severity flaws leading to unauthenticated arbitrary command execution and privilege escalation.

High-severity flaws leading to arbitrary file read/write/deletion, code execution, privilege escalation, command execution, information disclosure, and denial-of-service (DoS) were also resolved.

Juniper Networks discovered the bugs internally and is not aware of any of them being exploited in the wild.

In a separate advisory covering the PHP2Shell vulnerabilities, the company noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. It also investigated roughly a dozen other products and found none to be vulnerable.

Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related:Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Chrome and Firefox Updates Patch Over 200 Vulnerabilities
  • China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  • Hackers Start Probing Fresh Oracle EBS Vulnerability
  • Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
  • HPE Patches Dozens of Critical Flaws in Networking Products
  • Unexplained DreamHost Incident Prompts Email, FTP Password Resets
  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Genesys Hack Exposes Customer Data From Internal Systems

Latest News

  • BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
  • Over 41,000 DHS Employee Records Leaked Online
  • Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
  • Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
  • Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
  • HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
  • Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  • Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Trending

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Hackers Start Probing Fresh Oracle EBS Vulnerability

HPE Patches Dozens of Critical Flaws in Networking Products

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Quantum eMotion has named Wayne Teeple as CTO.

Guy Ellis has been appointed CEO of NCC Group.

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)