Adobe, Veeam, and Juniper Networks have each issued patches to address a range of vulnerabilities in their software products, including several that pose critical security risks. The patches aim to enhance security by mitigating issues that could otherwise be exploited for unauthorized code execution and other malicious activities.
Adobe’s Security Updates
This week, Adobe released fixes for 12 vulnerabilities affecting several of its products, such as Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter. Of particular concern are the eight critical issues in Campaign Classic, which involve code and command injection, incorrect authorization, and cross-site scripting (XSS) vulnerabilities. These flaws, if exploited, could allow attackers to execute arbitrary code, bypass security features, and escalate user privileges.
Additionally, Adobe Connect for both desktop and mobile platforms received an update to resolve another critical issue that could lead to arbitrary code execution. The updates for Creative Cloud and Substance 3D Painter addressed high- and medium-severity vulnerabilities that could result in code execution, privilege escalation, and memory leaks. Fortunately, Adobe reports no known active exploitation of these vulnerabilities.
Veeam’s Patch for Microsoft 365 and More
Veeam has rolled out fixes for nine security vulnerabilities across its products, including Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux. Among these, a critical vulnerability in Backup for Microsoft 365 could have allowed unauthorized access to read and write configuration data across tenants, potentially leading to remote code execution.
Additionally, a critical flaw in Backup & Replication exposed systems to unauthorized access, allowing attackers to bypass authentication. Veeam’s updates also addressed several high- and medium-severity issues, including REST API authentication bypass, arbitrary file operations, local privilege escalation, and bypassing multi-factor authentication.
Juniper Networks’ Extensive Security Patches
Juniper Networks addressed 18 vulnerabilities within its Session Smart Router and Session Smart Conductor platforms, including two critical ones that could result in unauthenticated command execution and privilege escalation. The patches also remedied high-severity issues related to file operations, code execution, information disclosure, and denial-of-service (DoS) attacks.
Importantly, Juniper Networks discovered these vulnerabilities internally and has not observed any exploitation attempts in the wild. The company also investigated other products in relation to the PHP2Shell vulnerabilities and confirmed no additional risks were found.
These updates are part of an ongoing effort by all three companies to maintain the security integrity of their products. Users are encouraged to apply these patches promptly to protect their systems from potential threats.
