Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

Summary: Fortinet, Ivanti, and SAP released security updates for multiple critical vulnerabilities, including a command injection flaw in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI tracked as CVE-2026-25089 with a CVSS score of 9.1. The Ivanti Sentry flaw CVE-2026-10520 allows unauthenticated attackers to send a crafted HTTP request to the /mics/api/v2/sentry/mics-config/handleMessage endpoint, resulting in arbitrary OS command execution as root, and CISA added it to its KEV catalog on June 11, 2026, with a June 14 fix deadline for FCEB agencies.
Why it matters: The Shadowserver Foundation reported a large volume of exploitation attempts against CVE-2026-10520 based on a public proof-of-concept, with at least two vulnerable instances already backdoored, while Ivanti has yet to update its advisory to reflect the exploitation status.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-10520 CVE-2026-25089 CVE-2026-27671
Related: ⚡ Weekly Recap: Chrome 0-Day, Uni Fi Exploits, macOS Stealers, VPN Flaw and More Cyber Risks ·
CVE-2026-25089: Fortinet Forti Sandbox OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jul 16, 2026
CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 11, 2026