Fortinet, Citrix and Ivanti released patches for 29 vulnerabilities on October 13, including critical flaws in Fortinet’s FortiSIEM and FortiSandbox products. No exploitation of the Fortinet or Citrix bugs has been reported.
Fortinet Fixes 13 Bugs, Two of Them Critical
Fortinet published 10 advisories covering 13 bugs. The two critical flaws are CVE-2026-106173, an unauthenticated arbitrary code execution vulnerability in FortiSIEM, and CVE-2026-107656, an authentication bypass in the FortiSandbox GUI.
The FortiSIEM and FortiSandbox flaws are the two items Fortinet rates critical; the other 11 bugs in its batch sit below that level. The tally covers advisories published on October 13 across FortiSIEM, FortiSandbox, FortiAnalyzer, FortiManager and FortiMail.
Five SQL Injection Flaws Rated High Severity
Fortinet also fixed four high-severity SQL injection flaws in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud, plus one in FortiMail webmail. All five let authenticated attackers run code or commands.
Citrix Addresses Nine Defects Across Three Advisories
Citrix issued three advisories for nine defects in Citrix Workspace App, XenServer 8.4 and 9, and UniconOS. The flaws include code execution, denial of service, information leaks, host compromise or a crash from within a virtual machine, privilege escalation, arbitrary command execution and arbitrary file read.
Guest-to-Host Risk in the Virtualization Platform
The listing of host compromise or a crash from within a VM places part of the Citrix batch in the virtualization layer, where a single guest can affect the machine that runs many others. The source does not break the nine defects down by product.
Ivanti Patches Seven Defects, Including the Exploited Connect Secure Flaw
Ivanti addressed seven defects. They include CVE-2026-104935 in Connect Secure, which attackers are exploiting and which is covered separately in reporting on the Connect Secure zero-day chain.
Critical Bugs in Neurons Patch for Intune and Xtraction
CVE-2026-109412, a critical flaw in Ivanti Neurons Patch for Intune, is an authentication information leak. Five fixes for Xtraction include a critical one, CVE-2026-106042, in which request redirection captures credentials for the EPMM connector.
Security-Management Products Under Scrutiny
The source reports no exploitation of the Fortinet or Citrix vulnerabilities. The only flaw in the batch with confirmed attacks is the Ivanti Connect Secure bug.
Edge devices and security-management tools have a history of being targeted by attackers, and this batch includes both kinds. A SIEM collects logs from across a network, a sandbox inspects suspicious files, and an Intune patching tool manages updates for enrolled devices. A flaw that lets an unauthenticated attacker run code on FortiSIEM, as CVE-2026-106173 does, would put an attacker on a system that sees much of an organization’s telemetry. The FortiSandbox authentication bypass, CVE-2026-107656, affects a product that organizations use to analyze malware samples.
FortiSIEM and FortiSandbox Carry the Unauthenticated Entry Points
The FortiSIEM and FortiSandbox flaws are the unauthenticated or authentication-bypass bugs and carry the highest ratings in the Fortinet group. The four SQL injection flaws in FortiAnalyzer and FortiManager require authentication, which narrows their reach to attackers who already hold an account.
Defenders who run products from all three vendors face a combined workload, and the Ivanti Connect Secure flaw in the batch is the only one the sources describe as under attack.
Ivanti’s Count Spans Three Products
Ivanti’s seven defects fall across Connect Secure, Neurons Patch for Intune and Xtraction. Of the seven, the Connect Secure flaw is exploited, the Intune bug is a critical leak of authentication information, and five are Xtraction fixes, one of them critical. That makes three of Ivanti’s seven rated or confirmed as the most serious items in the batch, all in different products with different owners inside a typical organization.
Citrix’s nine defects span three advisories, against Fortinet’s 13 bugs in 10 advisories. The sources give no severity ratings for the Citrix bugs.
