Ivanti, SAP, Fortinet RCE Flaws: Critical Patches You Need Now

Five major enterprise software vendors just dropped emergency security patches — and if your company runs any of these platforms, this needs to go to your IT team today. Ivanti, SAP, Fortinet, VMware, and n8n all fixed serious flaws ranging from remote code execution to SQL injection and privilege escalation. The worst one scores a 9.6 out of 10 on the severity scale.

The Hacker News (1.2M followers on LinkedIn) broke this story, and I’ve been watching these vendor patch cycles for years. What caught my attention this time is how many of these flaws allow attackers to get in without any password at all — authentication bypass is the theme running through most of these advisories.

The Ivanti Xtraction Flaw Is the One That Should Scare You Most

Let’s start with the headliner. CVE-2026-8043 is a critical vulnerability in Ivanti Xtraction — a business intelligence and reporting tool used by enterprises to pull data from systems like SAP, ServiceNow, and Oracle. CVSS score: 9.6 out of 10. That’s not a typo.

The flaw is classified as “external control of a file name or path” — which sounds technical, but here’s what it means in plain English. An attacker can manipulate which file the application references, which can lead to information disclosure or client-side attacks. Think of it like this: imagine you hand someone a document and they secretly swap the cover page with instructions to your bank. The system trusts the file name, not the contents.

What makes this worse is that Xtraction is specifically designed to aggregate sensitive business data. If an attacker exploits this, they’re not just getting into one system — they could potentially pull reports containing financials, HR records, or operational data from multiple connected platforms. I’ve seen Xtraction deployed in mid-to-large enterprises across the Gulf region and India. This one needs immediate attention.

Ivanti has released a patch. If you’re running Ivanti Xtraction, your IT team should be applying this update right now, not scheduling it for next month’s maintenance window.

SAP Vulnerabilities: SQL Injection and Privilege Escalation in Business-Critical Systems

SAP is the backbone of finance, HR, supply chain, and procurement for thousands of companies across India, UAE, Saudi Arabia, and the UK. So when SAP patches something serious, the blast radius is enormous.

This round of SAP fixes includes patches for SQL injection and privilege escalation vulnerabilities. SQL injection — in case you haven’t heard the term — is when an attacker inserts malicious database commands into an input field, tricking the system into handing over data it shouldn’t. Privilege escalation means a user who should have limited access finds a way to promote themselves to administrator level. Both are serious. Together, they’re a complete takeover path.

In my years working around SAP environments — including companies serviced by Indian IT giants like TCS, Infosys, Wipro, and HCL — I’ve noticed that patch deployment timelines are often stretched because of customisation concerns. Companies worry that a SAP patch will break their custom ABAP code or integrations. I understand the hesitation. But that calculus changes when the flaw has a high CVSS score and there’s a known exploitation technique available.

SAP’s May 2025 Security Patch Day advisories are now live. IT teams should cross-reference the SAP Support Portal and apply the relevant SAP Notes immediately — particularly for SAP NetWeaver and SAP BusinessObjects environments.

Fortinet and VMware: Authentication Bypasses That Let Attackers Walk Right In

Fortinet has had a rough couple of years with authentication bypass vulnerabilities — and this latest round continues that pattern. The fixes released this cycle address flaws that could allow unauthenticated attackers to execute arbitrary code. That means someone on the internet, with no username and no password, could potentially run commands on your system.

Fortinet gear is everywhere — firewalls, VPN concentrators, network access controllers. It’s heavily deployed across enterprise networks in Saudi Arabia and the UAE, particularly in financial services and government sectors. I’ve tracked this pattern for years: Fortinet publishes a patch, and within days researchers publish proof-of-concept exploit code. The window between patch and active exploitation is shrinking every cycle.

VMware’s patches this round address privilege escalation vulnerabilities in virtualisation components. VMware underpins most enterprise data centres — if an attacker escalates privileges inside a VMware environment, they can potentially move between virtual machines, which means one compromised workload can become a jumping-off point for the entire infrastructure. VMware (now under Broadcom) has published the advisories through its Security Advisories portal.

For both platforms: if you’re a network or systems administrator, check the vendor portals today. Don’t wait for your quarterly review cycle.

n8n Workflow Automation: A Lesser-Known Platform With a Real RCE Problem

Here’s one that surprised me. n8n is a workflow automation tool — think of it like Zapier or Make (formerly Integromat), but self-hostable and popular with developers and smaller tech teams. It’s gained significant traction in the past two years, especially among startups in India and the UK who want to build internal automations without paying enterprise SaaS prices.

The vulnerability patched in n8n this cycle allows for remote code execution (RCE) — the worst category of flaw. An attacker who can reach your n8n instance could execute arbitrary commands on the underlying server. If your n8n is self-hosted and exposed to the internet (many are, because that’s how webhook triggers work), this is a serious exposure.

The fix is available in the latest n8n release. If you’re running a self-hosted instance, go to your server, pull the latest Docker image or npm package, and restart the service. Don’t skip this one because n8n feels like a “small tool” — automation platforms often have access to API keys, database credentials, and webhook endpoints for your core business systems. A compromised n8n instance can cascade into much bigger problems.

What This Means For India, UAE, Saudi Arabia, and UK Users

India: The Indian IT services sector — TCS, Infosys, Wipro, HCL, Tech Mahindra — manages SAP and Oracle environments for thousands of global clients. When SAP patches drop, Indian IT teams are often the ones executing those patches on behalf of clients in Europe and North America. CERT-In (India’s Computer Emergency Response Team) has been increasingly active in issuing advisories aligned with major vendor patch days — check cert-in.org.in for the latest guidance. If you’re an IT professional at one of these firms, your client SLAs likely have patch deployment timelines baked in. This cycle should trigger those workflows immediately.

UAE and Saudi Arabia: Fortinet is a dominant network security vendor across Gulf enterprises and government networks. The authentication bypass flaws in this patch cycle are particularly relevant here. I’ve seen organisations in the region run Fortinet FortiGate and FortiProxy deployments that haven’t been patched in months — sometimes because of procurement and change management processes that slow everything down. That needs to change when you’re looking at unauthenticated RCE potential.

UK: VMware virtualisation is deeply embedded in UK financial services and NHS trust infrastructure. The UK’s NCSC (National Cyber Security Centre) regularly cross-posts CISA advisories for exactly these kinds of multi-vendor patch events. UK IT teams should check ncsc.gov.uk/news for any supplementary guidance issued alongside this patch cycle.

USA: CISA maintains its Known Exploited Vulnerabilities (KEV) catalog at cisa.gov/known-exploited-vulnerabilities-catalog. If any of these CVEs get added to the KEV list — which happens within days of active exploitation being confirmed — federal agencies and contractors face mandatory patch deadlines. Watch that list.

Digi Trendz Expert Take

Here’s my honest read on this situation. Five vendors patching in the same cycle isn’t a coincidence — it’s a sign that coordinated vulnerability research and disclosure is working, which is actually good news. Researchers are finding these flaws before attackers do (or at least before widespread exploitation). The system is functioning as intended.

What concerns me most, though, is the authentication bypass pattern I keep seeing across Fortinet and Ivanti products specifically. When a high-severity CVE doesn’t even require the attacker to have credentials, your entire defence shifts to “is this service reachable from the internet?” — and in many enterprise deployments, the honest answer is yes. Management interfaces, VPN endpoints, reporting dashboards — they’re all internet-facing in more organisations than they should be.

The n8n inclusion in this list is also a signal worth paying attention to. As more companies adopt developer-friendly automation tools outside of traditional IT procurement, the attack surface grows in places security teams aren’t watching. I’d expect to see more CVEs hitting tools like n8n, Zapier alternatives, and low-code platforms over the next 12 months. If your company uses any self-hosted automation platform, it needs to be on your vulnerability management radar — not treated as a side project.

If I were advising a mid-sized company right now, I’d tell them: patch Ivanti Xtraction and Fortinet first, today, because the severity scores and authentication bypass potential make those the highest-priority items. SAP next, because the data exposure risk is enormous. VMware and n8n after that, but within 72 hours.

6 Specific Steps to Take Right Now

1. Patch Ivanti Xtraction immediately: Log in to the Ivanti Customer Success portal at forums.ivanti.com, navigate to Downloads, search for Xtraction, and download the latest build addressing CVE-2026-8043. Deploy to your Xtraction server and restart the service. Don’t schedule this — do it today.
2. Apply SAP May 2025 Security Notes: Log in to the SAP Support Portal at support.sap.com, go to “My Support” → “Patches & Upgrades” → “Security Patch Day”, filter by May 2025, and have your Basis team apply all High and Very High priority notes, focusing on SAP NetWeaver and BusinessObjects components.
3. Update Fortinet firmware via FortiGate CLI or GUI: In your FortiGate management console, go to System → Firmware → Firmware Management, check for the latest stable release addressing this cycle’s advisories, and schedule the upgrade during your next maintenance window — ideally within 48 hours.
4. Update VMware/Broadcom virtualisation components: Log in to the Broadcom Support Portal at support.broadcom.com, search for the relevant VMware Security Advisories (VMSA) published in May 2025, and apply the patches to your ESXi hosts and vCenter Server through the vSphere Lifecycle Manager.
5. Update your n8n self-hosted instance: If you’re running n8n via Docker, run docker pull n8nio/n8n:latest followed by docker-compose up -d in your n8n directory. If using npm, run npm update -g n8n. Verify the version number in the n8n Settings → About panel after restart.
6. Audit internet-facing management interfaces: Use Shodan (shodan.io) to search your organisation’s IP ranges for exposed Fortinet, Ivanti, or VMware management interfaces. Any results should be moved behind a VPN or firewall rule immediately — management UIs should never be directly reachable from the public internet.

For more detailed guidance on patching enterprise systems safely, check out our cybersecurity how-to guides on Digi Trendz.

Bottom Line

A 9.6 CVSS score on Ivanti Xtraction, authentication bypasses on Fortinet, RCE on n8n, and SQL injection in SAP — this is not a minor patch Tuesday. If your organisation runs any of these platforms, “we’ll get to it” is not an acceptable answer this week. Patch Ivanti and Fortinet first, get SAP done within 48 hours, and make sure someone on your team is watching the CISA KEV catalog for escalation signals.