Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws

Summary: Ivanti, Fortinet, n8n, SAP, and VMware released fixes for vulnerabilities that could allow authentication bypass and arbitrary code execution, led by a critical Ivanti Xtraction flaw (CVE-2026-8043, CVSS 9.6) that lets a remote authenticated attacker read sensitive files and write arbitrary HTML to a web directory. Fortinet patched two critical flaws in FortiAuthenticator and FortiSandbox, SAP fixed CVE-2026-34263 (unauthenticated configuration upload and code injection from overly permissive rule ordering) and CVE-2026-34260 (SQL injection with read-only data access), Broadcom addressed a TOCTOU flaw in VMware Fusion (CVE-2026-41702, CVSS 7.8) allowing local privilege escalation to root, and n8n had five critical vulnerabilities.
Key Takeaway: SAP's CVE-2026-34263 needs no credentials at all - an unauthenticated user can upload configuration and inject code that runs on the server - and the VMware Fusion flaw turns any local non-admin account into root.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-34260 CVE-2026-34263 CVE-2026-41702 CVE-2026-8043
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026