Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws.
This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter.
The Campaign Classic update resolves eight critical-severity bugs, including code/command injection, incorrect authorization, and XSS issues.
Successful exploitation could lead to arbitrary code execution, security feature bypass, and privilege escalation, Adobe warns in a priority 2 advisory.
Another critical-severity defect leading to arbitrary code execution was addressed in Adobe Connect for desktop and mobile.
The security updates for Creative Cloud and Substance 3D Painter resolve high- and medium-severity security holes leading to code execution, privilege escalation, and memory leaks.
Adobe says it is not aware of any of these vulnerabilities being exploited in the wild.
Veeam rolled out fixes for nine security defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux.
In Backup for Microsoft 365, Veeam fixed four flaws, including a critical issue that could have allowed attackers to read/write configuration data cross-tenant and achieve remote code execution.
It also resolved a critical-severity bug in Backup & Replication that could have allowed unauthenticated attackers to bypass authorization.
Veeam’s updates also resolved high- and medium-severity weaknesses leading to REST API authentication bypass, arbitrary file read or write, local privilege escalation, and multi-factor authentication bypass.
The company makes no mention of any of these security defects being exploited in the wild.
Juniper Networks patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, including two critical-severity flaws leading to unauthenticated arbitrary command execution and privilege escalation.
High-severity flaws leading to arbitrary file read/write/deletion, code execution, privilege escalation, command execution, information disclosure, and denial-of-service (DoS) were also resolved.
Juniper Networks discovered the bugs internally and is not aware of any of them being exploited in the wild.
In a separate advisory covering the PHP2Shell vulnerabilities, the company noted that CVE-2026-109618 affects Junos OS, but not in an exploitable way. It also investigated roughly a dozen other products and found none to be vulnerable.
Related: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities
