Security updates released on Tuesday resolve 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including multiple critical-severity bugs.
Citrix published three advisories detailing nine security defects impacting Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS.
Successful exploitation of the flaws could allow attackers to execute arbitrary code, cause denial-of-service (DoS) conditions, leak information, compromise or crash the host from within the VM, elevate privileges, execute arbitrary commands, and read arbitrary files.
Fortinet released 10 advisories dealing with 13 bugs, including two critical-severity issues in FortiSIEM and FortiSandbox GUI that could allow unauthenticated attackers to execute arbitrary code (CVE-2026-106173) and bypass authentication (CVE-2026-107656).
It also resolved four high-severity SQL injection vulnerabilities in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud, and another in FortiMail webmail. All five could allow authenticated attackers to execute arbitrary code or commands.
Ivanti rolled out patches for seven security defects in Connect Secure, Neurons Patch for Intune, and Xtraction.
The Connect Secure update deserves special attention, as it resolves CVE-2026-104935, an exploited zero-day that covers two underlying bugs chained together to compromise patched VPNs.
In Neurons Patch for Intune, Ivanti resolved CVE-2026-109412, a critical flaw that could allow attackers to leak sensitive authentication information.
The Xtraction update fixes five issues, including a critical bug (CVE-2026-106042) that could allow attackers to redirect application-generated requests and capture EPMM connector credentials.
Related: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
Related: Adobe Patches 176 Vulnerabilities Across 11 Products
Related: Refrigeration Controller Hack Spoils Food Across European Supermarkets
Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
