Citrix, Fortinet, and Ivanti Patch 29 Security Vulnerabilities
Major enterprise technology vendors have released comprehensive security updates to address a total of 29 vulnerabilities across multiple product lines, featuring critical-severity flaws that enable remote code execution, authentication bypasses, and sensitive information leaks.
Radwan AbdulhadiEditor and technology writer
Overview of Security Updates
Recent security updates released on Tuesday resolve a combined 29 vulnerabilities across software and infrastructure products from prominent technology providers, including Citrix, Fortinet, and Ivanti. The newly patched flaws span multiple critical-severity bugs capable of leading to authentication bypasses, arbitrary code execution, denial-of-service conditions, and sensitive information leaks.
Detailed information regarding the updates can be reviewed directly through vendor advisory channels, such as those provided by Citrix, Fortinet, and Ivanti.
Citrix Advisories and Impacted Products
Citrix published three distinct security advisories detailing a total of nine security defects. The affected products include Workspace App for Windows, XenServer 8.4, XenServer 9, and UniconOS.
Successful exploitation of these Citrix flaws could permit malicious actors to execute arbitrary code, trigger denial-of-service (DoS) conditions, leak sensitive information, and compromise or crash the host system directly from within a virtual machine. Additional risks involve privilege escalation, the execution of arbitrary commands, and reading arbitrary files.
Fortinet Patches Critical RCE and SQL Injection Flaws
Fortinet released 10 advisories addressing 13 separate security bugs. Among these are two critical-severity issues found within the FortiSIEM and FortiSandbox GUI components. These specific flaws could allow unauthenticated attackers to execute arbitrary code (CVE-2026-106173) or completely bypass authentication (CVE-2026-107656).
Furthermore, Fortinet resolved four high-severity SQL injection vulnerabilities impacting FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud, alongside an additional SQL injection flaw in FortiMail webmail. All five SQL injection vulnerabilities could allow authenticated attackers to execute arbitrary code or commands.
Ivanti Fixes Exploited Zero-Day and Critical Authentication Flaws
Ivanti rolled out patches to resolve seven security defects affecting Connect Secure, Neurons Patch for Intune, and Xtraction software. The update for Connect Secure requires immediate attention from system administrators because it addresses CVE-2026-104935, an exploited zero-day vulnerability that utilizes two underlying bugs chained together to compromise fully patched VPNs.
In Neurons Patch for Intune, Ivanti resolved CVE-2026-109412, a critical flaw capable of leaking sensitive authentication information. Meanwhile, the Xtraction update addresses five total issues, including a critical bug tracked as CVE-2026-106042 that allows attackers to redirect application-generated requests and capture EPMM connector credentials.
Broader Enterprise Cybersecurity Landscape
The simultaneous release of these critical security advisories highlights the ongoing and complex challenges faced by enterprise IT and security teams in maintaining secure infrastructure. Organizations utilizing affected products from Citrix, Fortinet, and Ivanti are strongly encouraged to apply the available patches promptly to mitigate potential exploit attempts.
Sources
- SecurityWeekCitrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Continue chronologically
Related stories
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws
Microsoft's October 2026 Patch Tuesday addresses a record-breaking 1,411 flaws, featuring three zero-day vulnerabilities and new risk cohorts.
FortiBleed Campaign Locks Victims Out of Fortinet Devices
The ongoing FortiBleed campaign has compromised tens of thousands of Fortinet devices globally, with attackers locking organizations out completely.
Hackers Exploit Citrix NetScaler Zero-Day Vulnerabilities
Cybersecurity firms report that attackers are actively exploiting Citrix NetScaler zero-day vulnerabilities to deploy web shells and tunneling malware.
Ivanti Patches Two More Connect Secure Zero-Days
Ivanti releases security updates for two additional Connect Secure gateway flaws chained in zero-day attacks since October, following a prior bug fix.
