SECURITY updates have addressed 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including several critical-severity flaws that could allow unauthenticated code execution, authentication bypass, DoS, or leakage of sensitive data. Citrix issued three advisories covering nine defects in Workspace App for Windows, XenServer 8.4 and 9, and UniconOS.
Fortinet released 10 advisories for 13 bugs, notably two critical issues in FortiSIEM and FortiSandbox GUI that could enable unauthenticated code execution (CVE-2026-106173) and authentication bypass (CVE-2026-107656). Fortinet also patched four high-severity SQL injection vulnerabilities across FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud, plus another in FortiMail webmail; all could permit attackers to execute arbitrary code or commands when authenticated.
Ivanti rolled out fixes for seven defects in Connect Secure, Neurons Patch for Intune, and Xtraction. The Ivanti Connect Secure update addresses CVE-2026-104935, a exploited zero-day that chained two bugs to compromise patched VPNs. In Neurons Patch for Intune, CVE-2026-109412 could allow leakage of sensitive authentication information, while Xtraction fixes include CVE-2026-106042, a critical bug that could redirect application-generated requests and capture EPMM connector credentials.
These patches underscore the ongoing risk landscape, with vendors stressing the importance of applying updates to mitigate potential real-world exploitation.