Adobe, Veeam and Juniper patch 39 flaws including critical RCE and auth bypass bugs
Adobe, Veeam and Juniper Networks released patches for more than three dozen vulnerabilities, several of them critical code execution and authorization bypass issues. Adobe fixed 12 flaws in Campaign Classic, Connect, Creative Cloud and Substance 3D Painter, with eight critical bugs in Campaign Classic alone. Veeam addressed nine defects across Backup for Microsoft 365, Backup & Replication, Veeam ONE and Veeam Agent for Linux, including a cross-tenant RCE and an unauthenticated authorization bypass. Juniper patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, two critical ones enabling unauthenticated arbitrary command execution and privilege escalation. None of the vendors report in-the-wild exploitation.
Entenda a falha
A vulnerabilidade
This is a batch of fixes from three vendors, not one flaw. Most severe: Veeam Backup for Microsoft 365 has a critical bug allowing cross-tenant read/write of configuration data and remote code execution. Veeam Backup & Replication has a critical unauthenticated authorization bypass. Juniper Session Smart Router and Conductor have two critical flaws giving unauthenticated arbitrary command execution and privilege escalation. Adobe Campaign Classic has eight critical code/command injection, incorrect authorization and XSS bugs, and Adobe Connect has one critical code execution bug. Juniper also said CVE-2026-109618 (PHP2Shell) affects Junos OS but not in an exploitable way. The articles give no version numbers. None of the vendors report in-the-wild exploitation.
Como funciona
The articles do not describe how these flaws work step by step. They only give the outcome of each class: in Veeam Backup for Microsoft 365, a tenant can reach configuration data of other tenants and end up running code; in Backup & Replication, an unauthenticated request can skip the authorization check; in the Juniper products, an unauthenticated actor can get arbitrary commands executed. In Adobe Campaign Classic, injection and authorization flaws lead to code execution, security feature bypass and privilege escalation.
Por que é vulnerável
The articles do not give root causes for individual bugs. The vulnerability classes named point to missing or wrong checks: code/command injection, incorrect authorization, missing tenant isolation in Veeam Backup for Microsoft 365, and authorization or authentication bypass in Veeam and Juniper. The vendor updates fix these, but the articles do not say what changed in the code.
Como foi descoberta
Juniper says it found its 18 Session Smart Router and Conductor bugs internally and knows of no exploitation. Adobe and Veeam published their fixes in security updates and, according to SecurityWeek, report or mention no in-the-wild exploitation. The articles do not say who found the Adobe or Veeam bugs. Separately, Juniper covered the PHP2Shell vulnerabilities in its own advisory, stating that CVE-2026-109618 affects Junos OS non-exploitably and that about a dozen other products it checked were not vulnerable.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 11:17.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- Adobe Campaign Classic: eight critical code/command injection, incorrect authorization and XSS flaws leading to arbitrary code execution, security feature bypass and privilege escalation (priority 2 advisory).
- Adobe Connect (desktop and mobile): critical arbitrary code execution flaw.
- Veeam Backup for Microsoft 365: four flaws, one critical allowing cross-tenant read/write of configuration data and remote code execution.
- Veeam Backup & Replication: critical unauthenticated authorization bypass; other issues include REST API authentication bypass, arbitrary file read/write, local privilege escalation and MFA bypass.
- Juniper Session Smart Router/Conductor: 18 bugs found internally, including arbitrary file read/write/deletion, code execution, information disclosure and DoS.
- PHP2Shell: Juniper stated CVE-2026-109618 affects Junos OS but not in an exploitable way; roughly a dozen other products were found not vulnerable.
Remediação
Apply the vendor updates for Adobe Campaign Classic and Connect, the Veeam product line, and Juniper Session Smart Router/Conductor, prioritising internet-exposed management interfaces.
Linha do tempo
-
Adobe, Veeam and Juniper patch 39 flaws including critical RCE and auth bypass bugs
ler a análise desta fonte ocultar
Adobe, Veeam and Juniper Networks released patches for more than three dozen vulnerabilities, several of them critical code execution and authorization bypass issues. Adobe fixed 12 flaws in Campaign Classic, Connect, Creative Cloud and Substance 3D Painter, with eight critical bugs in Campaign Classic alone. Veeam addressed nine defects across Backup for Microsoft 365, Backup & Replication, Veeam ONE and Veeam Agent for Linux, including a cross-tenant RCE and an unauthenticated authorization bypass. Juniper patched 18 vulnerabilities in Session Smart Router and Session Smart Conductor, two critical ones enabling unauthenticated arbitrary command execution and privilege escalation. None of the vendors report in-the-wild exploitation.
Technical Details
- Adobe Campaign Classic: eight critical code/command injection, incorrect authorization and XSS flaws leading to arbitrary code execution, security feature bypass and privilege escalation (priority 2 advisory).
- Adobe Connect (desktop and mobile): critical arbitrary code execution flaw.
- Veeam Backup for Microsoft 365: four flaws, one critical allowing cross-tenant read/write of configuration data and remote code execution.
- Veeam Backup & Replication: critical unauthenticated authorization bypass; other issues include REST API authentication bypass, arbitrary file read/write, local privilege escalation and MFA bypass.
- Juniper Session Smart Router/Conductor: 18 bugs found internally, including arbitrary file read/write/deletion, code execution, information disclosure and DoS.
- PHP2Shell: Juniper stated CVE-2026-109618 affects Junos OS but not in an exploitable way; roughly a dozen other products were found not vulnerable.
Remediation
Apply the vendor updates for Adobe Campaign Classic and Connect, the Veeam product line, and Juniper Session Smart Router/Conductor, prioritising internet-exposed management interfaces.