Vulnerabilitycritical
Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-13659+3 related CVEs | Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to… | 8.8 group max | 2% | ||
| CVE-2025-42880 | Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module | 9.9 | 5% | ||
| CVE-2025-42928 | Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution | 9.1 | 10% | ||
| CVE-2025-55754 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat | 9.6 | 10% | ||
| CVE-2025-59718 | Critical FortiCloud SSO Authentication Bypass in Fortinet FortiOS and FortiProxy | 9.8 | 68% | KEV | KEV |
| CVE-2025-59719 | Unauthenticated SAML Signature Bypass in Fortinet FortiWeb (FortiCloud SSO) | 9.8 | 29% |
From the original article
4 min read at thehackernews.com
Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution. The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 and CVE-2025-59719 (CVSS scores: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.