# Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)

> Between 2026-10-27 and 2026-10-28 Adobe, Veeam and Juniper patched critical flaws, including unauthenticated command execution and admin-privilege takeover in Juniper Session Smart Router/Conductor (CVSS 9.8), an unauthenticated authorization bypass in Veeam Backup & Replication (CVSS v4 9.1), and eight critical Adobe Campaign Classic flaws. No vendor reports in-the-wild exploitation.

- **Published:** 2026-10-29T13:55:45Z
- **Last reviewed:** 2026-10-29T13:55:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4744
- **ID:** TL-2026-4744
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-103409, CVE-2026-103406, CVE-2026-103408, CVE-2026-103402, CVE-2026-103407, CVE-2026-103390, CVE-2026-106079, CVE-2026-108142, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-48360, CVE-2026-109618, CVE-2026-109619

## Description

Adobe Campaign Classic v7 (APSB26-162, Priority 2, 2026-10-27) fixes eight critical flaws in build 7.4.4 build 9402 and earlier: code injection CVE-2026-104351 (CWE-94, 9.9), OS command injection CVE-2026-104353 (CWE-78, 9.9), incorrect authorization CVE-2026-105780 (CWE-863, 9.9), SQL injection CVE-2026-105489, CVE-2026-105781, CVE-2026-104354 and CVE-2026-105779 (CWE-89, 9.1-9.9) and reflected XSS CVE-2026-104350 (CWE-79, 9.3). The fix is build 9403. Adobe Connect (APSB26-182, 2026-10-27) fixes CVE-2026-48360, a code injection flaw (CWE-94, CVSS 9.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) allowing arbitrary code execution in Connect desktop clients (Windows 2026.8.51 and below, fixed 2026.9.61; Mac Silicon fixed 2026.10.66; Mac Intel fixed 2026.10.170; Android 4.4 and earlier, fixed 4.5).

Veeam Backup for Microsoft 365 8.6 (KB4957, 2026-10-27) fixes the critical CVE-2026-106076 (CVSS v4.0 9.0): SQL injection that lets an authenticated organization-transfer peer compromise the configuration database of the source server, giving cross-tenant configuration read/write and remote code execution as the PostgreSQL service account (affects 8.5.0.1014 and earlier v8 builds; fixed 8.6.0.1102). Related fixes: CVE-2026-106077 (admin arbitrary file read as LocalSystem, 8.3), CVE-2026-106078 (REST API authentication bypass via forged federation tokens, 6.9, fixed in 8.6 Patch 1 build 8.6.0.5011) and CVE-2025-64394 (arbitrary file write during install, 4.3). Veeam Backup & Replication 13.1.2 / 13.0.3 (KB4948, 2026-10-27) fixes the critical CVE-2026-108142 (CVSS v4.0 9.1, AV:N/AC:L/AT:P/PR:N/UI:N): an unauthenticated authorization bypass in the CDP Coordinator Service affecting 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x unaffected; fixed 13.1.2.57 and 13.0.3.63). Medium flaws CVE-2026-108140 and CVE-2026-108141 allow authenticated Restore Operators to write attacker-controlled files to arbitrary paths via relative path traversal, and CVE-2026-105477 is a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier (fixed 13.1.2.11).

Juniper bulletin JSA112183 (2026-10-28) fixes 18 vulnerabilities in Session Smart Router and Session Smart Conductor, found internally, affecting all versions before 7.0.5, 7.1.7 and 7.2.3. Two are critical (CVSS 9.8, no authentication): CVE-2026-103406 allows arbitrary command execution during key management on the Conductor, and CVE-2026-103409 (CWE-306, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) lets an unauthenticated network attacker obtain administrative privileges by sending crafted URL parameters to an insecure endpoint running as root; per one third-party analysis exploitation is only possible before the device is onboarded to Mist/Conductor. Other issues include CVE-2026-103408 (RCE via crafted DHCP options from an adjacent network), CVE-2026-103402 (PCLI unverified model-cache files leading to code execution and privilege escalation), CVE-2026-103407 (ConfigDirector path traversal), CVE-2026-103390 (HttpParser out-of-bounds read causing DoS) and CVE-2026-106079 (OS command injection). Juniper states there are no known workarounds; limit access to management interfaces and upgrade.

SecurityWeek also notes the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (PHP remote code execution, emergency PHP patches 2026-10-21); Juniper's investigation of about a dozen products found CVE-2026-109618 not exploitable in Junos OS. No vendor is aware of in-the-wild exploitation of any of the issues in this advisory, and no network or file IOCs have been published. Priority is patching internet-reachable and management-plane instances, especially Veeam servers (a common ransomware target) and Juniper SSR/Conductor.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1005 Data from Local System

## Sources

- [SecurityWeek: Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities](https://www.securityweek.com/adobe-veeam-juniper-networks-patch-critical-vulnerabilities/)
- [Adobe Security Bulletin APSB26-162 (Campaign Classic)](https://www.adobe.com/trust/security/products/campaign/apsb26-162)
- [Adobe Security Bulletin APSB26-182 (Connect)](https://www.adobe.com/trust/security/products/connect/apsb26-182)
- [Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6](https://www.veeam.com/kb4957)
- [Veeam KB4948: Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2](https://www.veeam.com/kb4948)
- [Juniper Fixes 18 Session Smart Router Vulnerabilities, Two Rated CVSS 9.8 (JSA112183)](https://securityonline.info/juniper-session-smart-router-vulnerabilities/)
- [CVE-2026-103409 Session Smart Router analysis](https://www.strix.ai/cve/CVE-2026-103409)
- [PHP2Shell - Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)](https://pentest-tools.com/vulnerabilities-exploits/php2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4744