Fortinet and Ivanti on Tuesday announced patches for 18 vulnerabilities across their product portfolios, including three critical-severity bugs.
Fortinet published 11 advisories describing as many bugs, including two dealing with critical-severity code execution security defects.
Tracked as CVE-2026-44277 (CVSS score of 9.1), the first of them is an improper access control issue in FortiAuthenticator that could be exploited remotely, without authentication, via crafted requests.
“FortiAuthenticator Cloud is not impacted by the issue, and hence customers do not need to perform any action,” the company says.
The second, tracked as CVE-2026-26083 (CVSS score of 9.1), is a missing authorization weakness affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI.
According to Fortinet, remote, unauthenticated attackers could send crafted HTTP requests to the vulnerable appliances to achieve code or command execution.
On Tuesday, Fortinet also resolved a high-severity out-of-bounds write vulnerability (CVE-2025-53844) in the FortiOS capwap daemon that could allow attackers to execute code on FortiGate devices. The attacker needs to control an authenticated FortiAP FortiExtender or FortiSwitch, the company says.
Fortinet also rolled out fixes for seven medium-severity flaws affecting FortiDeceptor WEB UI, FortiAP, FortiAP-U, FortiAP-W2 CLI, FortiAnalyzer, FortiManager, FortiTokenAndroid, FortiMail, and FortiNDR.
Ivanti published four advisories on Tuesday, detailing seven security defects impacting Ivanti Secure Access Client, Xtraction, Virtual Traffic Manager, and Endpoint Manager (EPM).
The most severe of these is CVE-2026-8043 (CVSS score of 9.6), described as an external control of a file name issue in Xtraction that could be exploited remotely to read sensitive files and write arbitrary HTML files to a web directory.
The company also resolved four high-severity vulnerabilities, including SQL injection and incorrect permissions assignment flaws in EPM, an OS command injection in Virtual Traffic Manager, and a race condition in Secure Access Client.
Successful exploitation of these bugs could lead to privilege escalation and remote code execution, the company says.
Both Fortinet and Ivanti said they were not aware of any of the patched vulnerabilities being exploited in the wild.
On Tuesday, Zoom rolled out patches for three security defects, including two high-severity issues in Rooms for Windows and Workplace VDI Plugin for Windows that could lead to privilege escalation.
Related: Chipmaker Patch Tuesday: Intel and AMD Patch 70 Vulnerabilities
Related: ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
