Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities, Including Exploited Ivanti Zero-Day
Citrix, Fortinet, and Ivanti have collectively released patches for 29 vulnerabilities across their product lines, with a critical zero-day in Ivanti Connect Secure being actively exploited.
Multiple cybersecurity vendors have issued urgent security updates to address a significant number of vulnerabilities affecting their products. Citrix, Fortinet, and Ivanti have collectively patched a total of 29 security flaws, ranging in severity from moderate to critical, with some allowing for arbitrary code execution, authentication bypass, and sensitive information leakage.
Citrix's security advisories detail nine vulnerabilities impacting its Workspace App for Windows, XenServer 8.4, and XenServer 9. The disclosed flaws could enable attackers to achieve arbitrary code execution, trigger denial-of-service conditions, leak sensitive information, compromise host systems from within virtual machines, elevate privileges, execute arbitrary commands, and read arbitrary files.
Fortinet has addressed 13 vulnerabilities through 10 separate advisories. Among these are two critical-severity bugs in FortiSIEM and FortiSandbox GUI, identified as CVE-2026-106173 and CVE-2026-107656, which could permit unauthenticated attackers to execute arbitrary code or bypass authentication mechanisms. Additionally, Fortinet resolved five high-severity SQL injection vulnerabilities across FortiAnalyzer, FortiManager, and FortiMail products, which could allow authenticated attackers to execute arbitrary code or commands.
Ivanti's updates cover seven security defects in its Connect Secure, Neurons Patch for Intune, and Xtraction products. The most notable fix is for CVE-2026-104935, a zero-day vulnerability in Ivanti Connect Secure that has been actively exploited in the wild. This flaw, chained with other underlying bugs, has been used to compromise VPNs.
Further details from Ivanti's releases include the patching of CVE-2026-109412, a critical vulnerability in Neurons Patch for Intune that could lead to the leakage of sensitive authentication information. The Xtraction product also received fixes for five issues, including CVE-2026-106042, a critical flaw enabling attackers to redirect application requests and steal EPMM connector credentials.
The coordinated release of patches highlights the ongoing threat landscape and the importance of timely security hygiene. Organizations utilizing products from these vendors are strongly advised to review the specific advisories and apply the necessary updates as soon as possible to mitigate the risks associated with these vulnerabilities.
While the specific threat actors behind the exploitation of the Ivanti Connect Secure zero-day have not been publicly detailed, the active exploitation indicates a high level of threat to organizations relying on these solutions. The broad range of vulnerabilities patched across these vendors underscores the need for continuous monitoring and proactive security measures.