Veeam, Adobe and Juniper Patch 39 Flaws, Including Critical Bugs

Three vendors, one week, dozens of serious bugs

Adobe, Veeam and Juniper Networks have released fixes for more than three dozen vulnerabilities between them. Several of the bugs are rated critical and could let an attacker run code, get around authorization checks or gain higher privileges.11 By vendor, Adobe fixed 12 flaws, Veeam fixed nine and Juniper fixed 18, for 39 in total. Separate write-ups of the same releases agree on these counts.1213

The headline is not a zero-day story, and that should be said plainly. All three vendors say they know of no attacks using these flaws, and none of the new Veeam or Juniper bugs had been added to the US government's catalog of known exploited vulnerabilities, run by CISA, when the patches came out.112224 Still, "not exploited yet" does not mean "safe to delay." Veeam itself warns that once a fix is public, attackers try to work backwards from the patch to build an exploit.1322 Of the three, Veeam's release matters most for defenders. Its products hold the backup copies that companies need to recover from a breach, and that makes them a target.

Adobe: Campaign Classic carries the risk

Most of Adobe's critical fixes are in Campaign Classic, which received patches for eight critical bugs. They include code and command injection, broken authorization and cross-site scripting. If exploited, they could allow code execution, security-feature bypass or privilege escalation.11 Adobe also fixed a critical code-execution flaw in Adobe Connect for desktop and mobile. The Creative Cloud and Substance 3D Painter updates fixed less severe issues that could still lead to code execution, privilege escalation or memory leaks.11

Adobe gave the Campaign Classic fix a priority 2 rating, a middle tier, and said none of the bugs had been exploited.11 Even so, a marketing platform is a riskier target than it sounds. One analysis notes that Campaign Classic systems often connect to customer databases and other internal systems, so a flaw that allows code execution or skips authorization there could reach data far beyond the marketing team.13 For anyone tracking data breaches, these customer-records systems are the part of Adobe's release to watch, not the creative apps.

Veeam: two critical flaws in backup software

Veeam published its fixes in three advisories on October 27. KB4948 covers Backup & Replication and Veeam Agent for Linux, KB4951 covers Veeam ONE (its monitoring tool), and KB4957 covers Backup for Microsoft 365, which received four fixes.22 Added together, that is the nine fixes described in broader coverage.11

The most reported bug is CVE-2026-108142, scored 9.1 on the CVSS 4.0 severity scale. It lets an attacker with no login get past authorization checks on the CDP Coordinator Service in Backup & Replication.1617 That service runs on the backup server, talks to VMware vCenter and manages continuous replication jobs.17 The flaw affects version 13.1.1.18 and earlier 13.1 builds, plus 13.0.2.29 and earlier 13.0 builds, on both Windows and the Veeam Software Appliance. Version 12.x is not affected.1618 The fixed builds are 13.1.2.57 and 13.0.3.63. Several outlets stress that administrators should check exact build numbers, because the main version number alone won't tell them whether they are safe.161725

Coverage differs most on how dangerous this bug is in practice. Some of the broader summaries list it next to code-execution flaws, which can suggest a worse impact.14 More careful reporting points out that Veeam has not described how an attack would work and has not said the bug allows remote code execution.1617 One analysis notes that Veeam's severity score requires certain extra conditions for an attack to succeed but doesn't say what they are. The same analysis classifies the bug as a "fail-open" weakness, meaning the system allows access instead of denying it when something goes wrong.17 The careful reading is the right one: this is a serious bypass of access checks on a sensitive service. Calling it a takeover bug goes beyond what Veeam has disclosed.

The second critical bug, in Backup for Microsoft 365, may matter more to cloud service providers. SecurityWeek reports it could let attackers read and write configuration data belonging to other tenants and achieve remote code execution.11 Another account adds that a logged-in peer in an organization-transfer setup could inject SQL commands into the configuration database.13 It is tracked as CVE-2026-106076 with a CVSS 4.0 score of 9.0.22 In multi-tenant setups, where one provider hosts backups for many customers, a flaw that crosses tenant boundaries is effectively a data breach waiting to happen. It deserves the same urgency as the Backup & Replication bug.

The less severe fixes are still worth applying. CVE-2026-107671 (CVSS 8.5) lets someone with valid Veeam ONE administrator credentials switch off multi-factor authentication for everyone before completing the MFA step.18 CVE-2026-105477 (7.3) allows privilege escalation in Veeam Agent for Linux, but only where the agent is managed by Backup & Replication. Two path-traversal bugs scored 5.9 let a Restore Operator who controls a backed-up network file share write files anywhere on the backup server.1618 HackerOne researchers reported the four KB4948 issues.16

Why backup servers draw ransomware gangs

The history explains why defenders take Veeam releases seriously. Four earlier Backup & Replication flaws are in CISA's exploited catalog, each marked as used in ransomware campaigns between 2022 and 2024.22 Reporting has linked one of them, CVE-2024-40711, to deployments of Frag ransomware.16 Companies depend on their backups to recover from ransomware or data corruption. An attacker who controls the backup system can disable that recovery or use the system's high-level access to move deeper into the network.13

This is also Veeam's second critical patch in a month. On October 6 the company fixed CVE-2025-64393, a CVSS 9.4 bug that let a low-privileged Backup Viewer account run code on version 12 backup servers.26 Singapore's Cyber Security Agency urged users to patch right away. So version 12 had a critical bug fixed early in the month and version 13 had one fixed late in the month. Teams running both versions will need to apply different fixes to each.

Juniper: a second round of router fixes

Juniper's 18 fixes in this batch cover Session Smart Router and Session Smart Conductor. Two are critical and allow command execution without a login and privilege escalation. The rest are high-severity bugs that could allow reading, writing or deleting files, code execution, information leaks and denial of service.11 Juniper says it found the bugs internally and knows of no exploitation.11

This release follows Juniper's much larger Junos OS bulletin of October 14. That one fixed a group of flaws scored 9.8 on the older CVSS 3.1 scale, affecting the J-Web management interface, the routing daemon and BGP monitoring code.14 Belgium's Centre for Cybersecurity and Singapore's Cyber Security Agency both told users to patch immediately. Belgium's advisory warned that some of the bugs could lead to full device takeover with no login and no user action.23 Researchers looking at the routing bugs note that a BGP daemon crash during a denial-of-service attack could turn a defensive tool into an outage across neighboring networks.6 Another analysis argues that each device's configuration decides real exposure: a device with J-Web turned off and no BMP monitoring station avoids six of the nine attack paths described.4 February brought an emergency fix for CVE-2026-21902 on PTX routers, and this month brings two bulletins, so Juniper customers have patched critical bugs repeatedly this year.9

How to prioritize

None of these flaws is a zero-day, and the reporting agrees on that. The same week showed how fast the situation can change: CISA added a top-severity GitLab bug to its exploited catalog on Thursday and gave federal agencies three days to patch.19 Unexploited bugs in widely deployed infrastructure tend to stay that way only until someone reverse-engineers the patch.

The fix order should follow where sensitive data lives:

• First: Veeam backup servers and multi-tenant Microsoft 365 backup deployments.
• Second: Juniper routing and management interfaces that untrusted networks can reach.
• Third: Adobe Campaign Classic systems that connect to customer databases.

The guidance also agrees that limiting network access to backup services is a stopgap, not a replacement for installing the patch.17