Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

Security updates released on Tuesday resolve 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including multiple critical-severity bugs.

Citrix published three advisories detailing nine security defects impacting Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS.

Successful exploitation of the flaws could allow attackers to execute arbitrary code, cause denial-of-service (DoS) conditions, leak information, compromise or crash the host from within the VM, elevate privileges, execute arbitrary commands, and read arbitrary files.

Fortinet released 10 advisories dealing with 13 bugs, including two critical-severity issues in FortiSIEM and FortiSandbox GUI that could allow unauthenticated attackers to execute arbitrary code (CVE-2026-106173) and bypass authentication (CVE-2026-107656).

It also resolved four high-severity SQL injection vulnerabilities in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud, and another in FortiMail webmail. All five could allow authenticated attackers to execute arbitrary code or commands.

Ivanti rolled out patches for seven security defects in Connect Secure, Neurons Patch for Intune, and Xtraction.

The Connect Secure update deserves special attention, as it resolves CVE-2026-104935, an exploited zero-day that covers two underlying bugs chained together to compromise patched VPNs.

In Neurons Patch for Intune, Ivanti resolved CVE-2026-109412, a critical flaw that could allow attackers to leak sensitive authentication information.

The Xtraction update fixes five issues, including a critical bug (CVE-2026-106042) that could allow attackers to redirect application-generated requests and capture EPMM connector credentials.

Related: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

Related: Adobe Patches 176 Vulnerabilities Across 11 Products

Related: Refrigeration Controller Hack Spoils Food Across European Supermarkets

Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.

Adobe Patches 176 Vulnerabilities Across 11 Products

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.

Google Partially Reverses Chrome Bug Bounty Cuts

Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.

Critical SonicWall Vulnerability Exploited Days After Disclosure

CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.