Fortinet and Ivanti on Tuesday announced fixes for over a dozen vulnerabilities across their product portfolios, including multiple high-severity flaws.
Ivanti released a Workspace Control (IWC) update to address three high-severity bugs that could lead to credential leaks.
Tracked as CVE-2025-5353, CVE-2025-22463, and CVE-2025-22455, the issues exist because of hardcoded keys in IWC versions 10.19.0.0 and prior, which could allow authenticated attackers to decrypt stored SQL credentials and environment passwords.
“We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program,” the company notes.
Fortinet released 14 patches on Tuesday, to address one high- and 13 medium-severity security defects.
The high-severity issue, tracked as CVE-2025-31104, is described as an OS command injection bug in FortiADC that could allow an authenticated attacker to execute arbitrary code using crafted HTTP requests.
The company fixed medium-severity flaws in FortiOS, FortiClientEMS, FortiClient for Windows, FortiPAM, FortiSRA, FortiSASE, FortiPortal, FortiProxy, and FortiWeb.
Attackers could exploit these issues to perform SSRF attacks, inject unauthorized sessions, redirect VPN connections, access unauthorized resources, access SSL-VPN settings, view device information, log into the SSL-VPN portal, elevate privileges, add SSH key files on the system, perform operations on behalf of a targeted user, spoof the identity of a downstream device, and connect from FortiClient via revoked certificates.
Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s PSIRT advisories page.
Related: Chrome, Firefox Updates Resolve High-Severity Memory Bugs
Related: ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, CISA
Related: Critical Vulnerability Patched in SAP NetWeaver
Related: Cometdocs Threatens Legal Action Over Disclosure of Security Issues
