Adobe, Veeam and Juniper Networks have released security updates addressing more than three dozen vulnerabilities across widely used enterprise, backup and networking products, including critical flaws that could allow attackers to execute code, bypass security controls or gain elevated privileges.
The patches affect products ranging from Adobe Campaign Classic and Adobe Connect to Veeam’s backup platforms and Juniper’s Session Smart networking infrastructure.
While none of the companies has reported known exploitation of the newly disclosed vulnerabilities in real-world attacks, organisations running affected software are being urged to update promptly because public disclosure gives attackers information they can potentially use to target systems that remain unpatched.
Adobe Fixes Critical Code Execution And Authorisation Flaws
Adobe addressed 12 vulnerabilities across Campaign Classic, Connect, Creative Cloud and Substance 3D Painter.
Campaign Classic received fixes for eight critical-severity vulnerabilities involving issues such as code or command injection, incorrect authorisation and cross-site scripting.
Successful exploitation of some of these vulnerabilities could allow arbitrary code execution, bypass security protections or enable privilege escalation.
Adobe also fixed a critical vulnerability affecting Adobe Connect on desktop and mobile platforms that could result in arbitrary code execution.
Additional vulnerabilities in Creative Cloud and Substance 3D Painter were rated high or medium severity and could potentially lead to code execution, privilege escalation or information exposure.
For businesses using Campaign Classic to manage large customer communication and marketing operations, vulnerabilities involving authorisation and code execution are particularly important because such platforms can be connected to sensitive databases and other internal systems.
Adobe said it was not aware of attacks exploiting the vulnerabilities when the fixes were released.
Veeam Patches Critical Backup Security Weaknesses
Veeam also released security fixes covering Backup for Microsoft 365, Backup & Replication, Veeam ONE and Veeam Agent for Linux.
One of the most serious vulnerabilities affects Veeam Backup & Replication and is tracked as CVE-2026-108142.
The vulnerability carries a CVSS v4.0 score of 9.1 and could allow an unauthenticated attacker to bypass authorisation on the Continuous Data Protection Coordinator Service.
Affected organisations need to move to fixed versions of Veeam Backup & Replication.
Another critical weakness affecting Backup for Microsoft 365 could allow an authenticated organisation-transfer peer to inject SQL into a configuration database, potentially enabling cross-tenant access to configuration information and remote code execution.
Veeam also fixed vulnerabilities involving REST API authentication bypass, arbitrary file access and privilege escalation.
Backup infrastructure is a particularly sensitive security target because organisations rely on it to recover systems after ransomware attacks, data corruption or other major incidents.
If attackers compromise backup administration platforms, they may be able to interfere with recovery mechanisms or use privileged backup systems as another route into an organisation’s network.
Veeam warned customers that once vulnerabilities and their fixes become public, attackers may attempt to reverse-engineer patches and use the information against systems that have not yet been updated.
Juniper Fixes 18 Session Smart Vulnerabilities
Juniper Networks addressed 18 vulnerabilities affecting its Session Smart Router and Session Smart Conductor products.
Two of the vulnerabilities were classified as critical and could allow unauthenticated arbitrary command execution or privilege escalation.
The remaining fixes include high-severity weaknesses that could potentially allow arbitrary file reading, writing or deletion, code and command execution, information disclosure and denial-of-service attacks.
Session Smart Router technology is used to manage and optimise network connectivity across distributed environments, making vulnerabilities in such systems particularly relevant to organisations with branch networks, cloud infrastructure and remote locations.
A flaw allowing commands to be executed without authentication can be especially dangerous because an attacker may not need an existing authorised account before attempting exploitation.
Juniper said the vulnerabilities were identified internally and that it was not aware of them being exploited in the wild when the patches were issued.
Public Disclosure Starts A New Security Clock
The absence of known exploitation does not mean organisations can safely delay installing the updates.
Before a vulnerability becomes public, attackers may know little about where the weakness exists. Once a vendor publishes a patch, security researchers and criminals can both analyse the differences between vulnerable and fixed versions.
That process can reveal how the flaw works.
Attackers can then scan the internet for systems that still run affected versions and attempt to build working exploits before administrators complete their patching cycles.
This creates a race between defenders deploying updates and attackers looking for organisations that have delayed them.
The latest Adobe, Veeam and Juniper releases are therefore less about responding to a confirmed mass-exploitation campaign and more about closing potential entry points before one develops.
For enterprise security teams, the immediate task is to identify whether affected products are present in their environments, confirm the versions being used and deploy the relevant vendor fixes.
Systems exposed directly to the internet or controlling critical functions such as backups and network infrastructure deserve particular attention.
The combined patch releases also underline a basic reality of enterprise cybersecurity: even trusted software responsible for communications, recovery and network management can contain vulnerabilities capable of becoming powerful attack paths if updates are ignored.
