Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws
Summary: Fortinet, Ivanti, and SAP released patches for critical flaws that could enable authentication bypass and code execution, including Fortinet's CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), which allow an unauthenticated attacker to bypass FortiCloud SSO login via a crafted SAML message when that feature is enabled. Ivanti patched CVE-2025-10573 (CVSS 9.6), a stored XSS in Endpoint Manager prior to 2024 SU4 SR1 that lets a remote unauthenticated attacker join fake managed endpoints and execute JavaScript in an administrator's session, while SAP issued December updates covering 14 vulnerabilities including three critical flaws.
Key Takeaway: The Ivanti flaw needs only that an administrator view a poisoned dashboard during routine work, and Rapid7's Douglas McKee calls the likelihood of triggering it during normal operations high - meaning the attacker's path to an admin session runs through a task your IT staff performs every day.