Threat reportVulnerabilityTL-2026-4744

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)

criticalPATCHED

Adobe, Veeam, Juniper Networks Patch Critical (TL-2026-4744), also tracked as PHP2Shell (related), is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-29. It has no confirmed attribution, affects Juniper Networks Session Smart Router / Session Smart Conductor, references 17 CVEs (CVE-2026-103409, CVE-2026-103406, CVE-2026-103408), maps to 4 MITRE ATT&CK techniques (T1005, T1059, T1190), and is covered by 9 detection rules and 4 indicators of compromise.

CVSS
9.8/10Critical
CVEs
17Referenced vulnerabilities
Techniques
4MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
4Indicators of compromise

Key facts for TL-2026-4744

Threat ID
TL-2026-4744
Also known as
PHP2Shell (related)
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, telecoms, finance, government administration, health, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
4

Malware and tooling in Adobe, Veeam, Juniper Networks Patch Critical

Malware and tooling: Adobe Connect

How Adobe, Veeam, Juniper Networks Patch Critical works

Between 2026-10-27 and 2026-10-28 Adobe, Veeam and Juniper patched critical flaws, including unauthenticated command execution and admin-privilege takeover in Juniper Session Smart Router/Conductor (CVSS 9.8), an unauthenticated authorization bypass in Veeam Backup & Replication (CVSS v4 9.1), and eight critical Adobe Campaign Classic flaws. No vendor reports in-the-wild exploitation.

Adobe Campaign Classic v7 (APSB26-162, Priority 2, 2026-10-27) fixes eight critical flaws in build 7.4.4 build 9402 and earlier: code injection CVE-2026-104351 (CWE-94, 9.9), OS command injection CVE-2026-104353 (CWE-78, 9.9), incorrect authorization CVE-2026-105780 (CWE-863, 9.9), SQL injection CVE-2026-105489, CVE-2026-105781, CVE-2026-104354 and CVE-2026-105779 (CWE-89, 9.1-9.9) and reflected XSS CVE-2026-104350 (CWE-79, 9.3). The fix is build 9403. Adobe Connect (APSB26-182, 2026-10-27) fixes CVE-2026-48360, a code injection flaw (CWE-94, CVSS 9.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) allowing arbitrary code execution in Connect desktop clients (Windows 2026.8.51 and below, fixed 2026.9.61; Mac Silicon fixed 2026.10.66; Mac Intel fixed 2026.10.170; Android 4.4 and earlier, fixed 4.5).

Veeam Backup for Microsoft 365 8.6 (KB4957, 2026-10-27) fixes the critical CVE-2026-106076 (CVSS v4.0 9.0): SQL injection that lets an authenticated organization-transfer peer compromise the configuration database of the source server, giving cross-tenant configuration read/write and remote code execution as the PostgreSQL service account (affects 8.5.0.1014 and earlier v8 builds; fixed 8.6.0.1102). Related fixes: CVE-2026-106077 (admin arbitrary file read as LocalSystem, 8.3), CVE-2026-106078 (REST API authentication bypass via forged federation tokens, 6.9, fixed in 8.6 Patch 1 build 8.6.0.5011) and CVE-2025-64394 (arbitrary file write during install, 4.3). Veeam Backup & Replication 13.1.2 / 13.0.3 (KB4948, 2026-10-27) fixes the critical CVE-2026-108142 (CVSS v4.0 9.1, AV:N/AC:L/AT:P/PR:N/UI:N): an unauthenticated authorization bypass in the CDP Coordinator Service affecting 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x unaffected; fixed 13.1.2.57 and 13.0.3.63). Medium flaws CVE-2026-108140 and CVE-2026-108141 allow authenticated Restore Operators to write attacker-controlled files to arbitrary paths via relative path traversal, and CVE-2026-105477 is a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier (fixed 13.1.2.11).

Juniper bulletin JSA112183 (2026-10-28) fixes 18 vulnerabilities in Session Smart Router and Session Smart Conductor, found internally, affecting all versions before 7.0.5, 7.1.7 and 7.2.3. Two are critical (CVSS 9.8, no authentication): CVE-2026-103406 allows arbitrary command execution during key management on the Conductor, and CVE-2026-103409 (CWE-306, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) lets an unauthenticated network attacker obtain administrative privileges by sending crafted URL parameters to an insecure endpoint running as root; per one third-party analysis exploitation is only possible before the device is onboarded to Mist/Conductor. Other issues include CVE-2026-103408 (RCE via crafted DHCP options from an adjacent network), CVE-2026-103402 (PCLI unverified model-cache files leading to code execution and privilege escalation), CVE-2026-103407 (ConfigDirector path traversal), CVE-2026-103390 (HttpParser out-of-bounds read causing DoS) and CVE-2026-106079 (OS command injection). Juniper states there are no known workarounds; limit access to management interfaces and upgrade.

SecurityWeek also notes the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (PHP remote code execution, emergency PHP patches 2026-10-21); Juniper's investigation of about a dozen products found CVE-2026-109618 not exploitable in Junos OS. No vendor is aware of in-the-wild exploitation of any of the issues in this advisory, and no network or file IOCs have been published. Priority is patching internet-reachable and management-plane instances, especially Veeam servers (a common ransomware target) and Juniper SSR/Conductor.

MITRE ATT&CK techniques used in TL-2026-4744

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Affected products and versions in Adobe, Veeam, Juniper Networks Patch Critical

  • Juniper Networks — Session Smart Router / Session Smart Conductor
    Vulnerable versions: before 7.0.5; 7.1.x before 7.1.7; 7.2.x before 7.2.3
    Fixed in: 7.0.5; 7.1.7; 7.2.3
  • Veeam — Backup & Replication
    Vulnerable versions: 13.1.1.18 and earlier 13.1 builds; 13.0.2.29 and earlier 13.0 builds
    Fixed in: 13.1.2.57; 13.0.3.63
  • Veeam — Backup for Microsoft 365
    Vulnerable versions: 8.5.0.1014 and earlier v8 builds; 8.6.0.1102 and earlier (REST API bypass)
    Fixed in: 8.6.0.1102; 8.6 Patch 1 (8.6.0.5011)
  • Adobe — Campaign Classic v7
    Vulnerable versions: 7.4.4 build 9402 and earlier
    Fixed in: 7.4.4 build 9403
  • Adobe — Connect
    Vulnerable versions: Windows 2026.8.51 and below; Mac Silicon 2026.08.45 and below; Mac Intel 2026.01.39 and below; Android 4.4 and earlier
    Fixed in: Windows 2026.9.61; Mac Silicon 2026.10.66; Mac Intel 2026.10.170; Android 4.5

Remediation for Adobe, Veeam, Juniper Networks Patch Critical

Patches

  • Adobe APSB26-162 and APSB26-182
  • Veeam KB4957 and KB4948
  • Juniper JSA112183

Immediate actions

  • Upgrade Juniper Session Smart Router and Conductor to 7.0.5, 7.1.7 or 7.2.3 or later (JSA112183)
  • Upgrade Veeam Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63)
  • Upgrade Veeam Backup for Microsoft 365 to 8.6.0.1102 and apply 8.6 Patch 1 (8.6.0.5011)
  • Update Adobe Campaign Classic v7 to 7.4.4 build 9403 and Adobe Connect to the fixed client builds

Workarounds

  • Juniper states there are no known workarounds; limiting access to management interfaces reduces exposure

Longer-term hardening

  • Restrict management interfaces of Juniper SSR/Conductor and Veeam servers to dedicated admin networks
  • Keep backup infrastructure off the production domain and monitor it as tier-0
  • Subscribe to vendor security bulletins and track KEV for these products

CVEs associated with Adobe, Veeam, Juniper Networks Patch Critical

Weaknesses (CWE) in Adobe, Veeam, Juniper Networks Patch Critical

CWE-306, CWE-94, CWE-78, CWE-863, CWE-89, CWE-79

Timeline of Adobe, Veeam, Juniper Networks Patch Critical

  • PHP ships emergency out-of-cycle patches for PHP2Shell (CVE-2026-109618, CVE-2026-109619); Juniper later reports CVE-2026-109618 not exploitable in Junos OS
  • Veeam publishes KB4948 and releases Backup & Replication 13.1.2 / 13.0.3 fixing critical unauthenticated authorization bypass CVE-2026-108142 in the CDP Coordinator Service
  • Veeam publishes KB4957 and releases Backup for Microsoft 365 8.6 fixing critical SQL injection CVE-2026-106076 (cross-tenant read/write and RCE)
  • Adobe releases APSB26-162 (Campaign Classic, 8 critical flaws, fixed 7.4.4 build 9403) and APSB26-182 (Connect CVE-2026-48360); no exploitation known
  • Juniper publishes JSA112183 fixing 18 Session Smart Router/Conductor flaws, including critical CVE-2026-103406 and CVE-2026-103409 (CVSS 9.8); versions 7.0.5, 7.1.7, 7.2.3
  • SecurityWeek reports the combined Adobe, Veeam and Juniper patches; vendors state no in-the-wild exploitation

Sources cited for Adobe, Veeam, Juniper Networks Patch Critical

Detection coverage for TL-2026-4744

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4744 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
4 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats