Vulnerabilities
Citrix, Fortinet and Ivanti Patch Critical Security Flaws in Key Products
Citrix, Fortinet and Ivanti have released patches for 29 vulnerabilities, including several critical flaws that could let attackers bypass authentication or run code on affected systems.
Ross GrantUpdated 3 min read
The short version
Citrix, Fortinet and Ivanti have fixed 29 security problems in their software. Some of these flaws could let hackers break in without a password or run their own code. One of the Ivanti bugs was already being used by attackers. If you use these products, you should update them as soon as possible.
What happened?
Citrix, Fortinet and Ivanti have released patches for 29 vulnerabilities in their products, including several critical flaws. Some of these bugs could allow attackers to bypass authentication, execute code remotely or leak sensitive information. One Ivanti vulnerability has already been exploited in the wild, according to SecurityWeek.
Multiple Vendors Release Security Updates
Citrix, Fortinet and Ivanti have released patches for a total of 29 vulnerabilities in their products, according to SecurityWeek (opens in a new tab). The updates address a range of issues, including several rated as critical. These flaws could allow attackers to bypass authentication, execute code remotely, or access sensitive information.
Details of the Vulnerabilities
Citrix issued three advisories covering nine vulnerabilities. The affected products include Workspace App for Windows, XenServer 8.4 and 9, and UniconOS. The most serious issues could let attackers run code on the system, cause denial-of-service (DoS) conditions, leak information, or even compromise the host from within a virtual machine (VM).
Fortinet released 10 advisories for 13 bugs. Two critical flaws stand out: one in FortiSIEM and another in the FortiSandbox graphical interface. The first (CVE-2026-106173) could let unauthenticated attackers run code on the system. The second (CVE-2026-107656) could allow attackers to bypass authentication controls. Fortinet also fixed several high-severity SQL injection bugs in FortiAnalyzer, FortiManager, and FortiMail, which could let authenticated users run commands they should not be able to.
Ivanti patched seven vulnerabilities in Connect Secure, Neurons Patch for Intune, and Xtraction. The Connect Secure update is especially important, as it fixes CVE-2026-104935, a zero-day vulnerability that has already been exploited in the wild. This issue involves two bugs chained together to compromise VPNs that were thought to be patched. Ivanti also addressed a critical bug in Neurons Patch for Intune (CVE-2026-109412) that could let attackers leak sensitive authentication data, and a critical flaw in Xtraction (CVE-2026-106042) that could allow attackers to capture credentials.
What Users and Organisations Should Do
Anyone running affected Citrix, Fortinet or Ivanti products should check for updates and apply patches as soon as possible. Critical vulnerabilities, especially those already exploited, present a real risk of compromise. Administrators should review vendor advisories for details on affected versions and mitigation steps.
Context and Next Steps
The fact that one of the Ivanti flaws (CVE-2026-104935) was already being exploited highlights the importance of patching quickly. Attackers often move fast to take advantage of newly disclosed bugs. While there is no information yet on whether other flaws have been exploited, organisations should assume that public advisories will attract attention from attackers.
As only SecurityWeek (opens in a new tab) has reported these updates so far, it is best to confirm details with the vendors directly and monitor for further advisories or government alerts.
Practical Advice
- Check your inventory for affected Citrix, Fortinet and Ivanti products.
- Read the official advisories when available and apply patches promptly.
- Monitor systems for signs of compromise, especially if you use Ivanti Connect Secure.
- Review user access and credentials, as some flaws could expose sensitive authentication data.
Staying on top of security updates is one of the most effective ways to reduce risk from known vulnerabilities.
Claimed vs confirmed
- Confirmed
Ivanti Connect Secure zero-day (CVE-2026-104935) has been exploited in the wild.
SecurityWeek reports this vulnerability has already been used by attackers.
- Unconfirmed
Citrix, Fortinet and Ivanti have released patches for 29 vulnerabilities.
Only SecurityWeek has reported this; no vendor advisories have been published yet.
The impact
- Money
- If breached, organisations could face costs from incident response, downtime, or possible regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global annual turnover.
- Reputation
- Organisations using affected products could face reputational damage if attackers exploit these flaws before patches are applied, especially if customer data is involved.
- Customers
- Customers using Citrix, Fortinet or Ivanti products should update as soon as possible to protect their systems and data from attack.
Why it matters
These products are widely used in businesses and government. Unpatched flaws could let attackers break in, steal data or disrupt services. Anyone running affected software should update quickly to protect their systems.
How does it work?
The vulnerabilities include bugs that allow attackers to bypass authentication checks, execute code remotely (remote code execution), and leak sensitive information. Some flaws involve chaining multiple bugs together to compromise systems, as seen in the Ivanti Connect Secure zero-day. SQL injection vulnerabilities let attackers run commands by sending specially crafted data to the application.
Key points
- 29 vulnerabilities patched across Citrix, Fortinet and Ivanti products
- Several critical flaws could allow code execution or authentication bypass
- One Ivanti VPN bug was already exploited in the wild
- SQL injection flaws fixed in multiple Fortinet products
- Patching quickly is essential to reduce risk
Sources
SecurityWeek
Reference
