[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7iIN2Vq7_QMNErUBrw6Z_aAE6QvEKrc6JyaQREEhkUY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"f20a02f6-d11d-4b0b-b5d9-b5bd4bdf98f4","critical-patches-released-for-citrix-fortinet-and-ivanti-including-actively-exploited-zero-day","f603eea9-bdca-44ee-84bd-f8484fabb8f1","Critical Patches Released for Citrix, Fortinet, and Ivanti — Including Actively Exploited Zero-Day","Vendors Citrix, Fortinet, and Ivanti collectively patched 29 vulnerabilities, including critical flaws enabling authentication bypass, remote code execution, and data leakage. Most alarming is an actively exploited zero-day in Ivanti Connect Secure VPN, where attackers chained two bugs together to achieve compromise — underscoring that unpatched network edge devices are prime targets. The fact that this zero-day was already being exploited in the wild at the time of disclosure means organizations that delayed patching were exposed. Network appliances like VPNs and firewalls are especially high-value targets because they sit at the perimeter and often have privileged access to internal systems. Prompt patching of these devices is not optional — it is a fundamental security baseline.","**Immediate actions:**\n- Apply all vendor-released patches for Citrix, Fortinet, and Ivanti products immediately, prioritizing internet-facing and perimeter devices.\n- Audit active sessions and logs on Ivanti Connect Secure VPN for indicators of compromise consistent with zero-day exploitation.\n- Temporarily isolate or restrict access to unpatched perimeter devices until patches can be applied.\n\n**Long-term improvements:**\n- Maintain a continuously updated asset inventory of all network appliances, including firmware versions and patch status.\n- Establish an emergency patching SLA (e.g., 24–48 hours) specifically for critical vulnerabilities on internet-facing infrastructure.\n- Implement network segmentation to limit lateral movement if a perimeter device such as a VPN gateway is compromised.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning targeting perimeter devices to detect unpatched systems before attackers do.\n- Enable centralized logging and alerting for anomalous authentication events on VPN and firewall appliances.\n- Subscribe to vendor security advisories and threat intelligence feeds to receive zero-day notifications in real time.",[12,13,14,15,16,17,18,19,20],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","ITIL: Change and Release Management","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{},"published","2026-10-14T08:20:30.977664+00:00","2026-10-14T08:20:30.959+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.securityweek.com\u002Fcitrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products\u002F","citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products-283a88","Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[44,47,50],{"slug":33,"name":45,"problem":46},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":39,"name":48,"problem":49},"Automated patch management","Known holes get closed in days, not months.",{"slug":51,"name":52,"problem":53},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]