Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10520 | Unauthenticated OS Command Injection in Ivanti Sentry | 10.0 | 100% | KEVPoC | KEV |
| CVE-2026-10523 | Unauthenticated Authentication Bypass in Ivanti Sentry Grants Full Admin Access | 9.8 | 52% | ||
| CVE-2026-22732 | When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be… | 9.1 | <1% | PoC | |
| CVE-2026-25089 | Unauthenticated OS Command Injection RCE in Fortinet FortiSandbox | 9.8 | 76% | KEV | KEV |
| CVE-2026-27671 | Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker… | 9.8 | <1% | ||
| CVE-2026-40128 | SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file… | 9.0 | <1% | ||
| CVE-2026-44748 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send… | 9.9 | <1% |
From the original article
4 min read at thehackernews.com
Ravie Lakshmanan Jun 10, 2026 Vulnerability / Patch Management Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure. The security flaw patched by Fortinet relates to a command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.