Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

On October 14, 2026, Citrix, Fortinet, and Ivanti released security updates resolving 29 vulnerabilities across their products. Citrix published advisories covering nine defects in Workspace App for Windows, XenServer 8.4 and 9, and UniconOS, with impacts including arbitrary code execution, denial-of-service, information leaks, privilege escalation, and file reading. Fortinet issued 10 advisories addressing 13 bugs, including two critical vulnerabilities in FortiSIEM and FortiSandbox GUI that allow unauthenticated code execution and authentication bypass (CVE-2026-106173 and CVE-2026-107656). Additionally, Fortinet fixed four high-severity SQL injection vulnerabilities in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud, and FortiMail webmail, potentially enabling authenticated attackers to execute arbitrary commands. Ivanti patched seven defects in Connect Secure, Neurons Patch for Intune, and Xtraction, including a zero-day exploited vulnerability (CVE-2026-104935) in Connect Secure VPNs and a critical flaw (CVE-2026-109412) in Neurons Patch for Intune that could leak sensitive authentication information. The Xtraction update addresses a critical bug (CVE-2026-106042) allowing request redirection and credential capture. No explicit affected versions or patch details are provided in the source content.

Successful exploitation of these vulnerabilities could allow attackers to bypass authentication mechanisms, execute arbitrary code remotely, leak sensitive authentication credentials, cause denial-of-service conditions, elevate privileges, and read or manipulate arbitrary files. The Ivanti Connect Secure zero-day was actively exploited, indicating real-world impact. Fortinet's critical vulnerabilities could be exploited by unauthenticated attackers, increasing risk. The SQL injection flaws in Fortinet products could enable authenticated attackers to execute arbitrary commands. Overall, these vulnerabilities pose significant risks to confidentiality, integrity, and availability of affected systems.

Security updates have been released by Citrix, Fortinet, and Ivanti to address these vulnerabilities. Organizations should apply the official patches from the respective vendors promptly. Since Ivanti's Connect Secure zero-day was exploited in the wild, immediate patching is critical. Fortinet and Citrix advisories should be reviewed for detailed patch instructions. No information indicates that any vulnerabilities remain unpatched or require temporary mitigations. Patch status should be confirmed by consulting the vendors' official advisories.