Critical Vulnerabilities Patched in Fortinet, Ivanti Products

Fortinet and Ivanti released patches for critical vulnerabilities in their products, including an OS command injection flaw (CVE-2026-25089) with a CVSS score of 9.8 in Fortinet’s FortiSandbox. This vulnerability could allow unauthenticated attackers to execute arbitrary commands. Fortinet also addressed two medium-severity flaws in FortiOS and FortiProxy. Meanwhile, Ivanti patched two critical vulnerabilities in Sentry, including CVE-2026-10520 with a CVSS score of 10, allowing unauthorized remote code execution.

Ivanti’s Endpoint Manager Mobile received high-severity patches for potential remote code execution vulnerabilities. Both companies reported no evidence of these flaws being exploited in the wild.

AI summary of the original article from SecurityWeek, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made

CVE-2026-25089 coverage
Published (UTC)	Outlet	Headline
Wed 10 Jun · 02:41 UTC	SecurityOnline	FortiSandbox flaw CVE-2026-25089 lets attackers run commands
Wed 10 Jun · 09:11 UTC	SecurityWeek	Critical Vulnerabilities Patched in Fortinet, Ivanti Products (this article)
Thu 11 Jun · 10:31 UTC	Security Affairs	Fortinet patches CVE-2026-25089 in FortiSandbox command injection
Tue 16 Jun · 14:28 UTC	Security Affairs	Fortinet warns of active exploits in unpatched FortiSandbox flaws
Wed 17 Jun · 07:21 UTC	SecurityWeek	3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs
Wed 17 Jun · 13:11 UTC	SOCRadar	FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code
Thu 16 Jul · 17:38 UTC	CISA	FortiSandbox Flaw Lets Hackers Run Code, CISA Warns
Thu 16 Jul · 18:39 UTC	CISA	CISA KEV Catalogue Adds FortiSandbox Flaw CVE-2026-25089
Fri 17 Jul · 04:50 UTC	SecurityOnline	CISA orders urgent patches for SharePoint, FortiSandbox flaws
Fri 17 Jul · 04:51 UTC	SecurityOnline	Red Hat OpenShift AI flaw lets attackers read local files
Fri 17 Jul · 10:01 UTC	SecurityOnline	292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users
Fri 17 Jul · 10:01 UTC	Infosecurity	CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities
Sat 18 Jul · 12:51 UTC	Security Affairs	CISA urges patch of FortiSandbox, SharePoint flaws amid exploits

CVE-2026-25089 coverage

Published (UTC)

Outlet

Headline

Wed 10 Jun · 02:41 UTC

SecurityOnline

FortiSandbox flaw CVE-2026-25089 lets attackers run commands

Wed 10 Jun · 09:11 UTC

SecurityWeek

Critical Vulnerabilities Patched in Fortinet, Ivanti Products (this article)

Thu 11 Jun · 10:31 UTC

Security Affairs