CVE Tools
Track your stack

Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

SecurityWeekBy Ionut Arghire

Reported exploitedCitrix Workspace AppCitrix XenServer

Our summary

Citrix, Fortinet, and Ivanti issued coordinated security updates this week addressing a combined total of 29 vulnerabilities, several rated critical. Citrix's three advisories cover nine flaws in Workspace App for Windows, XenServer 8.4/9, and UniconOS, with risks ranging from remote code execution and DoS to VM-to-host compromise and privilege escalation. Fortinet patched 13 bugs across ten bulletins, highlighted by two critical issues — unauthenticated RCE in FortiSIEM (CVE-2026-106173) and an authentication bypass in the FortiSandbox GUI (CVE-2026-107656) — plus SQL injection flaws in FortiAnalyzer, FortiManager, and FortiMail. Ivanti's seven fixes span Connect Secure, Neurons Patch for Intune, and Xtraction; most notably, Connect Secure receives a fix for CVE-2026-104935, an actively exploited zero-day chain that let attackers gain root access on fully patched VPN appliances, while Neurons Patch for Intune gets a critical credential-leak fix (CVE-2026-109412) and Xtraction addresses a critical request-redirection flaw (CVE-2026-106042) that could expose EPMM connector credentials.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and MoreCVE-2026-104935, CVE-2026-106173 +1
  2. The Hacker NewsAttacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So FarCVE-2026-104935, CVE-2026-106042 +1
  3. The Hacker NewsCritical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code ExecutionCVE-2026-106173
  4. Check Point Research19th October – Threat Intelligence ReportCVE-2026-104935
  5. Dark ReadingBeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge BugsCVE-2026-104935
  6. Cisco TalosThe Q3 Vulnerability Pulse: Discovery ≠ ExploitationCVE-2026-104935
  7. Dark ReadingIvanti ICS Zero-Day Attacks Highlight Vendor Patching HurdlesCVE-2026-104935
  8. BleepingComputerCISA warns admins to immediately fix Ivanti flaw exploited as zero-dayCVE-2026-104935
  9. The Hacker NewsCISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit AttemptsCVE-2026-104935
  10. Help Net SecurityAttackers chained three Ivanti zero-days to gain root on fully patched VPN appliancesCVE-2026-104935

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure