Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws

Asus, Zoom, and Cisco Release Security Patches for Router and Windows Vulnerabilities

Asus published an advisory covering four high- and medium-severity vulnerabilities in certain router firmware releases that could allow attackers to execute arbitrary commands with root privileges or overwrite memory and cause a crash. Zoom addressed two vulnerabilities in Workplace for Windows, including a critical unauthenticated privilege escalation flaw tracked as CVE-2026-108186 with a CVSS score of 9.6 and a second issue CVE-2026-108187 scoring 8.1 that also permits remote unauthenticated privilege escalation. Both flaws are fixed in Zoom Workplace for Windows versions 7.1.8 and later, with no indication of in-the-wild exploitation. Cisco updated multiple advisories with new details on Node2Shell impact, an authorization bypass affecting ISE and ISE-PIC, and the availability of fixes for seven critical- and high-severity CVEs in Meraki products. On Tuesday, both Cisco and SonicWall removed root certificates impacted by compromised eMudhra intermediate certificates. The updates arrived alongside hundreds of patches from Apple, Fortinet, Citrix, Ivanti, Intel, AMD, Microsoft, Adobe, SAP, and multiple ICS vendors.

N-able Releases Hotfixes for Multiple Zero-Day Vulnerabilities in N-central RMM Platform

N-able has issued security hotfixes addressing several zero-day vulnerabilities in its N-central remote monitoring and management platform. The flaws were publicly disclosed by researcher Sean Bales, who published proof-of-concept exploits after alleging prior reports went unaddressed. As a precaution, the company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions. The patches cover critical issues including remote code execution, XXE injection, OGNL injection, stored XSS, and local privilege escalation. Threat intelligence firm Defused reported active scanning and exploitation attempts against exposed servers, while Shadowserver noted a sharp drop in publicly reachable instances. On-premises customers are strongly urged to upgrade immediately following detailed guidance before restoring access.

Fortinet Issues 89 Advisories Fixing Nearly 100 Vulnerabilities Across Products

Fortinet released 89 security advisories addressing nearly 100 vulnerabilities in its product lineup. The update follows the company's recent integration of frontier AI models into its security testing processes. Seventeen of the flaws are rated critical, with several enabling arbitrary code execution, authentication bypass, and other high-impact attacks. FortiMail received the largest share of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. A notable FortiClient issue named Fortinet2Shell stems from a CORS misconfiguration that allows arbitrary code execution when FortiPAM is enabled. Nearly 80 additional high-severity vulnerabilities were also resolved, covering XSS, code injection, privilege escalation, and denial-of-service conditions.