Fortinet fixes critical FortiSIEM and FortiSandbox flaws as Citrix, Ivanti patch 29 bugs

Fortinet, Citrix and Ivanti released their October security updates on Tuesday, October 13, fixing a combined 29 vulnerabilities, according to SecurityWeek. The most urgent items for defenders are two critical Fortinet flaws that can be exploited without authentication: one in the FortiSIEM security information and event management platform and one in the FortiSandbox threat analysis appliance. Fortinet's advisories do not list either issue as exploited in the wild, but both affect security infrastructure that typically has broad visibility into corporate networks.

What happened

SecurityWeek reported that Fortinet addressed 13 bugs in 10 advisories, Citrix fixed 9 defects across 3 advisories, and Ivanti patched 7 defects. Ivanti's set includes CVE-2026-104935 in Connect Secure, the actively exploited zero-day chain disclosed earlier this week.

Technical details

According to Fortinet advisory FG-IR-26-180, CVE-2026-106173 is a path traversal flaw in the phQueryMaster gRPC component of FortiSIEM that lets an unauthenticated attacker write arbitrary files and execute code or commands via specially crafted packets. It carries a CVSS score of 9.4 and affects FortiSIEM 7.5.0; version 7.6 and FortiSIEM Cloud are not affected. The fix is in 7.5.1, and Fortinet says restricting access to TCP port 27918 prevents the issue.

Advisory FG-IR-26-185 describes CVE-2026-107656, an authentication bypass in the FortiSandbox web management interface rated 9.6. A remote, unauthenticated attacker could bypass login with crafted HTTP requests and execute unauthorized code or commands. FortiSandbox 5.0.0–5.0.6 and 4.4.0–4.4.9, as well as FortiSandbox PaaS 5.0 and 4.4, are affected; fixes are in 5.0.7 and 4.4.10, while FortiSandbox 5.2 is not affected. Fortinet said the bug was found internally and also reported by TrendAI Research.

Fortinet also fixed SQL injection flaws in FortiAnalyzer and FortiManager (FG-IR-26-178, CVSS 7.9) that let a low-privileged user run commands; fixed builds include 7.6.5 and 7.4.8 (FortiManager 7.4: 7.4.7), while 7.2 users must migrate to a fixed release. SecurityWeek noted an additional high-severity SQL injection in FortiMail webmail.

For Citrix, SecurityWeek said the advisories cover Workspace App for Windows, XenServer 8.4, XenServer 9 and UniconOS, with impacts ranging from code execution and privilege escalation to host compromise or crash from inside a virtual machine. Ivanti fixed critical CVE-2026-109412 in Neurons Patch for Intune, which could leak authentication information, and critical CVE-2026-106042 in Xtraction, which could let attackers capture EPMM connector credentials.

What to do

Organizations running FortiSIEM 7.5.0 or FortiSandbox should upgrade first; where FortiSIEM cannot be updated immediately, block access to TCP port 27918 as Fortinet advises. FortiManager and FortiAnalyzer 7.2 users should plan a migration to a supported branch. Citrix XenServer and Workspace App and Ivanti Neurons and Xtraction administrators should review the vendors' October advisories and apply updates.