Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products

What it is

A same-day roundup of fixes from three vendors: 29 vulnerabilities in total, split Citrix 9, Fortinet 13 and Ivanti 7. The one already exploited in the wild is Ivanti Connect Secure CVE-2026-104935.

How it works

• Ivanti Connect Secure, CVE-2026-104935: an exploited zero-day made of two underlying bugs chained together. The page says the chain compromises patched VPNs, so earlier patching did not protect these appliances. It gives no further mechanism.
• Fortinet FortiSIEM and FortiSandbox GUI: two critical flaws that unauthenticated attackers can use. CVE-2026-106173 gives arbitrary code execution and CVE-2026-107656 bypasses authentication. The page does not say which CVE belongs to which product.
• Fortinet SQL injection (five bugs): four affect FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud, and one affects FortiMail webmail. All five are rated high severity and require authentication, but they can lead to arbitrary code or command execution.
• Ivanti Neurons Patch for Intune, CVE-2026-109412 (critical): can leak sensitive authentication information.
• Ivanti Xtraction, CVE-2026-106042 (critical): attackers can redirect requests the application generates and capture EPMM connector credentials. This is one of five issues fixed in the Xtraction update.
• Citrix: three advisories cover nine defects in Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS. Impacts listed are code execution, DoS, information leaks, host compromise or crash from within a VM, privilege escalation, arbitrary command execution and arbitrary file read. The page does not tie each impact to a product.

Preconditions / Affected

• Connect Secure: any appliance exposed as a VPN. The page names no versions.
• FortiSIEM and FortiSandbox GUI: the critical bugs need no credentials, so network reachability of the management interface is the main factor.
• Fortinet SQL injection: needs a valid authenticated account.
• Citrix: XenServer 8.4 and 9 only, Workspace App for Windows, and UniconOS.

What to do

Apply the vendor updates. Priority order, based on the page:

1. Connect Secure, because it is actively exploited and prior patch level does not protect you.
2. The unauthenticated critical FortiSIEM and FortiSandbox fixes.
3. Ivanti Xtraction and Neurons Patch for Intune. These leak credentials, and Xtraction exposes EPMM connector credentials. Those credentials may need rotating if you were exposed, though the page does not say so.
4. The Fortinet SQL injection fixes and the Citrix advisories.

Caveats

The page gives no fixed version numbers, no indicators of compromise, no workarounds and no CVSS scores. You will need the vendor advisories for those. It also does not say how widely CVE-2026-104935 has been exploited.