Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday

October 14, 2026: the same day Microsoft absorbed most of the security oxygen with a record 1,411-CVE Patch Tuesday, Citrix, Fortinet, and Ivanti each released patch batches of their own. Combined, the three vendors addressed 29 vulnerabilities across a mix of network edge appliances, management platforms, and endpoint tooling. The headline CVEs are critical severity, and at least two of them are unauthenticated.

According to SecurityWeek’s coverage, all patches were released on October 14, 2026.

Fortinet: 13 CVEs, 10 advisories

Fortinet’s October batch covers 13 vulnerabilities across 10 advisories. The most severe is CVE-2026-106173 (CVSS 9.8, critical), an unauthenticated remote code execution flaw in the FortiSIEM and FortiSandbox graphical interfaces. An attacker with network access to the affected interface can execute code on the host without credentials. Fortinet also patched an authentication bypass in those same products that allows unauthenticated access, though specific CVE assignment has not yet resolved in NVD at publication time.

Additional fixes cover SQL injection vulnerabilities in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud, and the FortiMail webmail interface. Fortinet rates these high-severity rather than critical; exploitation requires authentication. FortiManager has been a recurring target this quarter: CVE-2026-104286 was added to the CISA Known Exploited Vulnerabilities catalog earlier this month. Organizations already in cleanup mode there should close the SQL injection chain in the same patch window.

Ivanti: 7 CVEs, 3 products

Ivanti’s October batch includes 7 vulnerabilities. The most urgent is CVE-2026-104935, the actively exploited zero-day chain in Connect Secure that allowed root access on fully patched VPNs; CISA set a remediation deadline of October 16 and that story has its own dedicated coverage.

Two other critical flaws in this batch warrant attention. CVE-2026-109412 (CVSS 9.9) affects Ivanti Neurons Patch for Intune and can expose sensitive authentication information to an attacker. CVE-2026-106042 (CVSS 9.9) affects Ivanti Xtraction, an analytics platform used in managed service environments, and allows an attacker to redirect application requests in a way that captures credentials. Both carry CVSS scores just under the absolute maximum. Patches are available for all three products.

Ivanti’s history here is not encouraging for anyone running a large fleet of their products: the September patch cycle covered critical RCE flaws in Neurons, EPMM, and Sentry, and CVE-2026-104935 was apparently known to attackers before Ivanti published its advisory. The October batch is not described as exploited in the wild beyond CVE-2026-104935, but that does not mean it is safe to leave for a later window.

Citrix: 9 CVEs, 3 advisories

Citrix addressed 9 vulnerabilities across three advisories covering Workspace App for Windows, XenServer, and UniconOS. The vulnerability classes include code execution, denial of service, privilege escalation, information disclosure, and arbitrary file reading. Citrix has not disclosed CVE identifiers in the initial advisory summaries; NVD entries are expected to follow.

Citrix has had a busy October: CVE-2026-107406, a CVSS 9.5 unauthenticated RCE in NetScaler, landed five days ago, and a third NetScaler zero-day in two weeks was patched October 5. This October 14 batch is separate from those advisories and covers different product lines, but the net effect for Citrix administrators is three distinct patch cycles to track in under two weeks.

Patch priority

All three vendors released patches today. The October 16 CISA deadline for Ivanti CVE-2026-104935 is the hardest deadline in the batch, but CVE-2026-106173 in Fortinet’s FortiSIEM and FortiSandbox products is unauthenticated RCE at CVSS 9.8 and should be treated as equally urgent for any organization running those products. The Citrix list can move alongside your normal Patch Tuesday maintenance cycle. None of the October 14 Citrix or Fortinet CVEs are currently listed as exploited in the wild.