Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

What it is

SecurityWeek's roundup of October 2026 patches from Adobe, Veeam and Juniper Networks. The page gives no CVE IDs for the new fixes and no fixed version numbers. It names only CVE-2026-109618 (PHP2Shell), and it links to no advisories in the text, so engineers must look up the vendor advisories for builds.

Affected

Adobe (12 flaws). Products are Campaign Classic, Connect, Creative Cloud and Substance 3D Painter.

• Campaign Classic has eight critical bugs: code/command injection, incorrect authorization and XSS. Adobe rates the update priority 2 and warns of arbitrary code execution, security feature bypass and privilege escalation.
• Adobe Connect (desktop and mobile) has one critical arbitrary code execution flaw.
• Creative Cloud and Substance 3D Painter have high and medium bugs leading to code execution, privilege escalation and memory leaks.

Veeam (9 flaws). Products are Backup for Microsoft 365, Backup & Replication, Veeam ONE and Veeam Agent for Linux.

• Backup for Microsoft 365 has four fixes. One is critical: cross-tenant read/write of configuration data that leads to remote code execution.
• Backup & Replication has a critical authorization bypass that unauthenticated attackers can use.
• The remaining high and medium issues cover REST API authentication bypass, arbitrary file read or write, local privilege escalation and MFA bypass.

Juniper (18 flaws). Products are Session Smart Router and Session Smart Conductor.

• Two are critical: unauthenticated arbitrary command execution and privilege escalation.
• High-severity issues include file read/write/deletion, code execution, command execution, information disclosure and DoS.
• Juniper found the bugs internally.

What to do

Apply the vendor updates. Prioritise the unauthenticated or cross-tenant paths: Veeam Backup & Replication, Veeam Backup for Microsoft 365, and the two critical Juniper Session Smart flaws. Adobe Campaign Classic is the other priority, given the eight critical bugs and Adobe's priority 2 rating.

Junos OS needs no action for PHP2Shell. Juniper's separate advisory says CVE-2026-109618 affects Junos OS but is not exploitable there. Juniper also checked roughly a dozen other products and found none vulnerable.

Caveats

None of the three vendors reports exploitation in the wild. The page gives no version boundaries, no CVE IDs for the critical bugs and no workarounds.