Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

Security updates released on Tuesday resolve 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including multiple critical-severity bugs.

Citrix published three advisories detailing nine security defects impacting Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS.

Successful exploitation of the flaws could allow attackers to execute arbitrary code, cause denial-of-service (DoS) conditions, leak information, compromise or crash the host from within the VM, elevate privileges, execute arbitrary commands, and read arbitrary files.

Fortinet released 10 advisories dealing with 13 bugs, including two critical-severity issues in FortiSIEM and FortiSandbox GUI that could allow unauthenticated attackers to execute arbitrary code (CVE-2026-106173) and bypass authentication (CVE-2026-107656).

It also resolved four high-severity SQL injection vulnerabilities in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud, and another in FortiMail webmail. All five could allow authenticated attackers to execute arbitrary code or commands.

Ivanti rolled out patches for seven security defects in Connect Secure, Neurons Patch for Intune, and Xtraction.

The Connect Secure update deserves special attention, as it resolves CVE-2026-104935, an exploited zero-day that covers two underlying bugs chained together to compromise patched VPNs.

In Neurons Patch for Intune, Ivanti resolved CVE-2026-109412, a critical flaw that could allow attackers to leak sensitive authentication information.

The Xtraction update fixes five issues, including a critical bug (CVE-2026-106042) that could allow attackers to redirect application-generated requests and capture EPMM connector credentials.

Related: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

Related: Adobe Patches 176 Vulnerabilities Across 11 Products

Related: Refrigeration Controller Hack Spoils Food Across European Supermarkets

Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

XWorm RAT Evolves Into Surveillance Platform

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

Refrigeration Controller Hack Spoils Food Across European Supermarkets

Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US

iRhythm Data Breach Impacts at Least 360,000 People

Critical SonicWall Vulnerability Exploited Days After Disclosure

Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Adobe Patches 176 Vulnerabilities Across 11 Products

Google Partially Reverses Chrome Bug Bounty Cuts

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?

Learn Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.

Virtual Event: Zero Trust & Identity Strategies Summit 2026

Join as we decipher the world of zero trust and war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Flipboard Whatsapp Whatsapp Email