Ivanti, Fortinet, SAP, VMware, n8n Drop Patches for Critical RCE and Privilege Flaws

Another Tuesday, Another Patch Gauntlet

Five vendors dropped security fixes in close succession, and if you're managing a mixed enterprise environment. This round deserves immediate triage rather than the usual "schedule it for next week" treatment.

Ivanti Xtraction: CVE-2026-8043 (CVSS 9.6)

The headline item is CVE-2026-8043 in Ivanti Xtraction, scoring a 9.6. The vulnerability class is described as "external control of a file name," which is a pattern we associate with path traversal and arbitrary file reference bugs. The practical outcomes here are information disclosure and client-side attacks, think scenarios where an unauthenticated or low-privileged actor can point the application at attacker-controlled resources. Ivanti has had a rough stretch with high-severity CVEs over the past couple of years, and Xtraction. A reporting and analytics layer, is exactly the kind of secondary product that tends to sit unpatched longer than core gateway products. If Xtraction is in your environment, treat this with the same urgency you'd give an Ivanti Connect Secure finding.

Fortinet: Authentication Bypass and RCE in the Mix

Fortinet is on the list again, which will surprise approximately no one who has been tracking their disclosure cadence. The source flags authentication bypass and remote code execution class vulnerabilities. For operators running FortiGate, FortiManager, or adjacent products, the standing advice applies: check your firmware version against the advisory the moment it publishes, and don't wait for your vendor TAM to reach out. Fortinet's patch notes are dense but accurate — read them.

SAP: SQL Injection Surfaces

SQL injection in enterprise ERP components is the kind of finding that sounds almost retro, but the blast radius in an SAP environment is anything but. Successful exploitation of a SQL injection flaw in a backend SAP component can mean direct database access, privilege escalation, and lateral movement into connected systems. SAP environments often have complex, long-standing integrations that make patching non-trivial. But that complexity is exactly why attackers target them. If you have a SAP Basis team, loop them in now rather than after the exploit PoC drops.

VMware: Privilege Escalation

Privilege escalation in VMware products is a recurring theme, and in virtualized environments it carries outsized risk. A local privilege escalation that lets an attacker move from guest to host, or from a low-privileged service account to SYSTEM within a VM, can unravel a lot of segmentation assumptions. The source doesn't specify which VMware product is affected, that detail may be in the full advisory. So check the original source link for specifics before you scope your exposure.

n8n: RCE in a Workflow Automation Tool

This is the one that might catch some teams off guard. n8n is an open-source workflow automation platform that's gained significant traction as a self-hosted alternative to Zapier or Make. If your organization has engineers or data teams running self-hosted n8n instances. And many do, often outside the formal security perimeter, an RCE vulnerability is a serious problem. Self-hosted automation tools frequently hold API keys, OAuth tokens, and database credentials as part of their normal operation. An RCE here isn't just a server compromise; it's potentially a credential harvest across every integration that instance touches. Hunt down those deployments.

Prioritization Framework for This Round

Given the breadth here, a rough triage order:

1. Ivanti Xtraction — 9.6 CVSS, file name control, patch or isolate immediately.
2. n8n self-hosted instances — high credential exposure risk, likely untracked in your asset inventory.
3. Fortinet — authentication bypass + RCE is a critical combination on perimeter devices.
4. SAP — SQL injection with broad data access implications, complex patching process warrants early start.
5. VMware — privilege escalation risk depends heavily on your virtualization architecture and who has local access.

The through-line across all five: these aren't obscure edge-case products. They're infrastructure. The window between advisory publication and active exploitation has compressed to days, sometimes hours, for high-CVSS findings from vendors with this kind of install base.

Full technical details and affected version specifics are available at the original reporting from The Hacker News.