Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws

According to Fortinet, Ivanti, and SAP, they have moved to address critical security flaws in their products that could allow authentication bypass and remote code execution. The Fortinet flaws affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and are tracked as CVE-2025-59718 and CVE-2025-59719, with CVSS scores of 9.8, and involve improper verification of a cryptographic signature that could bypass FortiCloud SSO login if enabled.

Ivanti released fixes for four Endpoint Manager vulnerabilities, including CVE-2025-10573, which has a CVSS of 9.6 and stems from stored XSS that could let a remote unauthenticated attacker execute arbitrary JavaScript in an administrator session; other patched CVEs in the same update include CVE-2025-13659, CVE-2025-13661, and CVE-2025-13662.

SAP’s December updates address 14 vulnerabilities across multiple products, including CVE-2025-42880 (9.9) in SAP Solution Manager, CVE-2025-55754 (9.6) in SAP Commerce Cloud, and CVE-2025-42928 (9.1) in the SAP jConnect SDK for ASE, with Onapsis credited for reporting two of these flaws. To help reduce risk in the interim, organisations are advised to disable FortiCloud login if enabled and apply the patches promptly as exploits continue to loom.