cyber.hendryadrian.com
Security News · thehackernews.com

Fortinet, Ivanti and SAP Patch Critical Vulnerabilities Across Multiple Products

· Original article ↗

Summary

Fortinet, Ivanti, and SAP released patches for critical vulnerabilities affecting FortiSandbox, Ivanti Sentry, and SAP platforms. The article reports no evidence of in-the-wild exploitation.

Key points

  • Fortinet fixed CVE-2026-25089, an unauthenticated command-injection flaw affecting FortiSandbox products; affected versions should be upgraded to the listed fixed releases.
  • Ivanti patched CVE-2026-10520, which could permit unauthenticated root-level code execution in Ivanti Sentry, and CVE-2026-10523, an authentication bypass that could enable full administrative access.
  • The article describes CVE-2026-10520 exploitation through a crafted HTTP request to an Ivanti Sentry endpoint; the patch adds access controls requiring authentication.
  • SAP issued fixes for four critical flaws affecting NetWeaver AS ABAP, ABAP Platform, Commerce Cloud, Data Hub, and NetWeaver Application Server Java.
  • The SAP issues include XML signature verification, memory corruption, potential Spring security, and directory traversal vulnerabilities.
  • The article reports no evidence that the vulnerabilities have been exploited in the wild and recommends updating to fixed versions.

Article Details

Event Type
Security updates released for critical vulnerabilities in Fortinet, Ivanti, and SAP products.
Impact
The vulnerabilities could enable unauthenticated command execution or root-level remote code execution, authentication bypass and administrative access, memory corruption, directory traversal, or unauthorized access to sensitive data. Patches are available. The article reports no evidence of in-the-wild exploitation.

CVE

CVE-2026-10520ivanti · SentryIvanti patched CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry.CVE-2026-10523Ivanti · Standalone sentryIvanti patched CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry.CVE-2026-22732Vmware · Spring securityCVE-2026-22732 (CVSS score: 9.1) – Potential Spring security vulnerability within SAP Commerce Cloud and SAP Data HubCVE-2026-25089Fortinet · FortiSandbox; Fortinet · FortiSandbox Cloud; +1 moreFortinet fixed CVE-2026-25089 in FortiSandbox and related products.CVE-2026-27671Vendor / Product unavailableCVE-2026-27671 (CVSS score: 9.8) – Memory corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP PlatformCVE-2026-40128Vendor / Product unavailableCVE-2026-40128 (CVSS score: 9.0) – Directory traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)CVE-2026-44748Vendor / Product unavailableCVE-2026-44748 (CVSS score: 9.9) – XML signature wrapping vulnerability in SAML authentication in SAP NetWeaver AS ABAP and ABAP Platform

People

Sonny MacdonaldIdentified as a security researcher; commented that Ivanti's patch added authentication controls in front of the vulnerable endpoint.

Vendors

FortinetFortinet, Ivanti, and SAP have issued urgent security updates for multiple critical flaws that could enable remote code execution, authentication bypass, and information disclosure.IvantiFortinet, Ivanti, and SAP have issued urgent security updates for multiple critical flaws that could enable remote code execution, authentication bypass, and information disclosure.SAPFortinet, Ivanti, and SAP have issued urgent security updates for multiple critical flaws that could enable remote code execution, authentication bypass, and information disclosure.

Products

ABAP PlatformSAP released fixes for four critical flaws in NetWeaver, ABAP Platform, Commerce Cloud, and Data Hub.FortiSandboxThe affected products include FortiSandbox, Ivanti Sentry, and several SAP platforms, with no evidence yet of in-the-wild exploitation.FortiSandbox CloudThe security flaw patched by Fortinet relates to a command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI.FortiSandbox PaaSThe security flaw patched by Fortinet relates to a command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI.Ivanti SentryThe affected products include FortiSandbox, Ivanti Sentry, and several SAP platforms, with no evidence yet of in-the-wild exploitation.NetWeaver AS ABAPCVE-2026-44748 (CVSS score: 9.9) – XML signature wrapping vulnerability in SAML authentication in SAP NetWeaver AS ABAP and ABAP PlatformSAP Commerce CloudRounding off the list of updates is SAP, which pushed out fixes for four critical vulnerabilities in NetWeaver AS ABAP and ABAP Platform, as well as SAP Commerce Cloud and SAP Data Hub –SAP Data HubRounding off the list of updates is SAP, which pushed out fixes for four critical vulnerabilities in NetWeaver AS ABAP and ABAP Platform, as well as SAP Commerce Cloud and SAP Data Hub –SAP NetWeaver Application Server JavaCVE-2026-40128 (CVSS score: 9.0) – Directory traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

Related Articles