Veeam and Juniper patch critical flaws enabling code execution and authorization bypass

Enterprise software vendors Veeam and Juniper Networks have released patches for critical vulnerabilities in widely deployed backup and networking products, SecurityWeek reports, alongside a critical round of fixes from Adobe. None of the three vendors says it is aware of the flaws being exploited in the wild, but the severity of several issues makes prompt patching advisable.

What happened

According to SecurityWeek, Veeam addressed nine security defects spanning Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux. Juniper Networks, in an advisory SecurityWeek links as its October 2026 release, patched 18 vulnerabilities in its Session Smart Router and Session Smart Conductor products. Adobe rounded out the week with its own critical fixes. SecurityWeek says the vendors released the updates "this week" and does not list specific release dates for each.

Technical details

SecurityWeek reports that the most serious Veeam issue is a Backup for Microsoft 365 flaw that could allow cross-tenant read/write access to configuration data and remote code execution. A separate Backup & Replication flaw could let unauthenticated attackers bypass authorization. Other high- and medium-severity Veeam issues include a REST API authentication bypass, arbitrary file read/write, local privilege escalation, and a multi-factor authentication bypass. For Juniper, SecurityWeek says two of the Session Smart flaws are critical, allowing unauthenticated arbitrary command execution and privilege escalation, while high-severity issues include arbitrary file operations, code execution, privilege escalation, information disclosure and denial-of-service. SecurityWeek notes the article does not include CVE identifiers, CVSS scores or fixed version numbers for the Veeam and Juniper flaws.

Who is affected

The affected products are mainstays of enterprise IT: Veeam's backup and replication suite is used to protect data across Microsoft 365, virtual and physical environments, while Juniper's Session Smart Router and Conductor are deployed in enterprise and service-provider networks. SecurityWeek also notes that a separate Juniper advisory covers CVE-2026-109618 affecting Junos OS in connection with the PHP2Shell issue, but "not in an exploitable way," and that Juniper found none of about a dozen other products vulnerable.

What to do

Because SecurityWeek reports that Veeam's Backup for Microsoft 365 and Backup & Replication flaws can lead to code execution and authorization bypass, and that Juniper's Session Smart products contain unauthenticated command-execution bugs, administrators should apply the vendors' latest updates as soon as testing allows. Teams should consult Veeam's and Juniper's official advisories for the exact fixed versions and affected builds, prioritize internet-facing and multi-tenant deployments, and review access to backup infrastructure, which is a frequent target for attackers seeking to disrupt recovery.