Asus, Zoom, and Cisco Release Security Patches for Router and Windows Vulnerabilities

Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws

Citrix and Ivanti released patches on Tuesday for 19 vulnerabilities across their products, addressing several critical- and high-severity issues. Ivanti fixed 13 flaws in five products, including two critical vulnerabilities in Cloud Services Application and Endpoint Manager that could enable remote attacks without authentication. The CSA issue tracked as CVE-2026-121683 allows attackers to add or delete trusted certificate entries, while the EPM flaw CVE-2026-121653 permits unauthenticated remote code execution via SQL injection. Citrix addressed six defects in XenServer, including CVE-2026-102705 that could expose the Pool Secret, along with mitigations for AMD CPU vulnerabilities affecting virtual machines. Neither vendor has observed active exploitation of the disclosed issues in the wild.

N-able Releases Hotfixes for Multiple Zero-Day Vulnerabilities in N-central RMM Platform

N-able has issued security hotfixes addressing several zero-day vulnerabilities in its N-central remote monitoring and management platform. The flaws were publicly disclosed by researcher Sean Bales, who published proof-of-concept exploits after alleging prior reports went unaddressed. As a precaution, the company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions. The patches cover critical issues including remote code execution, XXE injection, OGNL injection, stored XSS, and local privilege escalation. Threat intelligence firm Defused reported active scanning and exploitation attempts against exposed servers, while Shadowserver noted a sharp drop in publicly reachable instances. On-premises customers are strongly urged to upgrade immediately following detailed guidance before restoring access.

Fortinet Issues 89 Advisories Fixing Nearly 100 Vulnerabilities Across Products

Fortinet released 89 security advisories addressing nearly 100 vulnerabilities in its product lineup. The update follows the company's recent integration of frontier AI models into its security testing processes. Seventeen of the flaws are rated critical, with several enabling arbitrary code execution, authentication bypass, and other high-impact attacks. FortiMail received the largest share of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. A notable FortiClient issue named Fortinet2Shell stems from a CORS misconfiguration that allows arbitrary code execution when FortiPAM is enabled. Nearly 80 additional high-severity vulnerabilities were also resolved, covering XSS, code injection, privilege escalation, and denial-of-service conditions.