Fortinet and Ivanti released security updates addressing multiple critical vulnerabilities, primarily OS command injection flaws exploitable remotely without authentication. Fortinet's most severe issue, CVE-2026-25089 (CVSS 9.8), affects FortiSandbox and related cloud and PaaS products, allowing arbitrary command execution via crafted HTTP requests. Ivanti patched CVE-2026-10520 (CVSS 10) in Sentry, enabling remote root-level code execution, and CVE-2026-10523 (CVSS 9.9), an authentication bypass allowing creation of admin accounts. Additional medium and high severity vulnerabilities were also fixed. No active exploitation has been observed. Fortinet patched affected versions FortiSandbox 5.0.6 and 4.4.9, FortiSandbox Cloud 5.0.6, and FortiSandbox PaaS 5.0.6. Ivanti released Sentry versions 10.5.2, 10.6.2, 10.7.1 and Endpoint Manager Mobile versions 12.9.0.1, 12.8.0.3, and 12.7.0.2 with fixes.

Successful exploitation of these vulnerabilities allows remote, unauthenticated attackers to execute arbitrary OS commands with root privileges on affected Fortinet and Ivanti products. This can lead to full system compromise, unauthorized administrative access, and potential control over network appliances. The authentication bypass in Ivanti Sentry further enables attackers to create privileged user accounts, escalating access without prior credentials. No exploitation in the wild has been reported to date.

Official patches have been released by Fortinet and Ivanti for all identified vulnerabilities. Organizations should promptly apply Fortinet patches for FortiSandbox versions 5.0.6 and 4.4.9, FortiSandbox Cloud 5.0.6, and FortiSandbox PaaS 5.0.6. Ivanti users should upgrade to Sentry versions 10.5.2, 10.6.2, or 10.7.1 and Endpoint Manager Mobile versions 12.9.0.1, 12.8.0.3, or 12.7.0.2. No additional mitigations are indicated by the vendors. Monitoring for unusual activity remains prudent but is not a substitute for patching.