Fortinet has addressed two critical vulnerabilities, tracked as CVE-2025-59718 and CVE-2025-59719, with a CVSS score of 9.8, affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. These flaws involve improper verification of a cryptographic signature, allowing an unauthenticated attacker to bypass the FortiCloud Single Sign-On (SSO) login authentication via a crafted SAML message, but only if the FortiCloud SSO login feature is enabled. This feature is not enabled by default, but it becomes active when an administrator registers the device to FortiCare and does not disable the administrative login toggle. As a temporary measure, organizations are advised to disable this feature until the updates can be applied, which can be done through the system settings or by running a command in the command-line interface.
Ivanti also released updates to fix four security vulnerabilities in Endpoint Manager (EPM), including a critical severity flaw identified as CVE-2025-10573 with a CVSS score of 9.6. This vulnerability is a stored cross-site scripting (XSS) issue in EPM prior to version 2024 SU4 SR1, which allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of an administrator’s session. The attack works by sending a fake device report to the primary EPM web service to poison the administrator web dashboard with malicious JavaScript. The exploit is triggered when an administrator views one of these poisoned interfaces, leading to the attacker gaining control of the administrator’s session. Experts note that while user interaction is required, the likelihood of an administrator viewing the dashboard during routine work is high, making the risk serious and the exploit trivial.
This critical flaw, CVE-2025-10573, has been patched in EPM version 2024 SU4 SR1. While the company stated it is not aware of any attacks in the wild, the vulnerability’s threat level remains significant due to its exploitation potential, especially when combined with social engineering efforts. The same update also addressed three other high-severity vulnerabilities: CVE-2025-13659, CVE-2025-13661, and CVE-2025-13662. Like the Fortinet flaws, CVE-2025-13662 also stems from an improper verification of cryptographic signatures, but this time within the patch management component, which could allow a remote, unauthenticated attacker to achieve arbitrary code execution.
Finally, SAP has released its December security updates, patching 14 vulnerabilities across multiple products, including three critical-severity flaws. These include CVE-2025-42880, a code injection vulnerability in SAP Solution Manager with a CVSS score of 9.9, which enables an authenticated attacker to inject arbitrary code into a central system component. The second critical flaw is CVE-2025-55754, which represents multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud with a CVSS score of 9.6. The third flaw is CVE-2025-42928, a deserialization vulnerability in SAP jConnect SDK for Sybase Adaptive Server Enterprise (ASE) with a CVSS score of 9.1, which could allow for remote code execution by providing specially crafted input, although it requires elevated privileges for a successful exploit.
Given the frequent targeting of security vulnerabilities in Fortinet, Ivanti, and SAP products by malicious actors, it is vital that all users move swiftly to apply these released patches. Experts emphasize the necessity of timely patching for systems like SAP Solution Manager due to its central role in the overall SAP landscape, alongside implementing rigorous user interface sanitization and privilege segmentation to further strengthen security. The convergence of these critical flaws across major vendors highlights an ongoing requirement for organizations to maintain a proactive and aggressive patching strategy.
Reference:
The post Urgent Patches Issued For Major Flaws first appeared on CyberMaterial.