Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Three major vendors shipped security updates this week addressing more than three dozen flaws, several rated critical for remote code execution. Adobe patched 12 vulnerabilities across Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter, with Campaign Classic alone receiving fixes for eight critical bugs tied to injection, authorization, and XSS issues that could enable code execution or privilege escalation. Veeam addressed nine flaws in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux, including a critical cross-tenant data exposure and RCE bug in Backup for Microsoft 365 and a critical authorization bypass in Backup & Replication. Juniper Networks closed 18 internally discovered issues in Session Smart Router and Session Smart Conductor, two of them critical and capable of unauthenticated command execution and privilege escalation, and separately clarified that the PHP2Shell flaw CVE-2026-109618 affects Junos OS only in a non-exploitable manner. None of the vendors report active exploitation of these issues.