Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

Fortinet, Ivanti, and SAP have released security patches for critical vulnerabilities affecting their products that could lead to arbitrary code execution and information disclosure.

• •Fortinet patched CVE-2026-25089 (CVSS 9.1), a command injection vulnerability in FortiSandbox affecting versions 4.4.0-4.4.8 and 5.0.0-5.0.5
• •Ivanti released fixes for CVE-2026-10520 (CVSS 10.0) allowing root-level remote code execution and CVE-2026-10523 (CVSS 9.9) enabling authentication bypass in Ivanti Sentry
• •SAP addressed four critical vulnerabilities including XML signature wrapping (CVE-2026-44748), memory corruption (CVE-2026-27671), Spring security flaw (CVE-2026-22732), and directory traversal (CVE-2026-40128)
• •The patches incorporate additional security controls such as endpoint access blocking and authentication enforcement