Fortinet, Ivanti, and ServiceNow patch 15 flaws, including a critical no-login attack on ServiceNow's AI platform
A flaw rated 9.5 out of 10 in severity lets criminals run malicious code on ServiceNow systems without needing a password. Twelve Fortinet products and two Ivanti tools also received fixes on the same day.
Key points
- ServiceNow patched CVE-2026-6875, a critical flaw scored 9.5 out of 10 that lets attackers run malicious code on its AI platform without logging in.
- Ivanti fixed two flaws in its Xtraction data tool: CVE-2026-14902 can silently redirect users to malicious websites, and CVE-2026-14903 can let attackers read files they should never reach.
- Fortinet released 11 advisories on Tuesday covering 12 vulnerabilities spread across ten products.
- None of the three vendors report seeing any of these flaws actively exploited.
Three major software companies released security fixes on Tuesday for a combined 15 vulnerabilities: discovered weaknesses that attackers could use to cause harm.
The most urgent fix came from ServiceNow, which makes software businesses use to manage IT support tickets and employee requests, and now artificial-intelligence tools. ServiceNow patched CVE-2026-6875, a remote code execution flaw that lets someone run malicious instructions on another company's server from anywhere over the internet, without a username or password. Severity: 9.5 out of 10.
ServiceNow says it has already pushed the fix automatically to cloud-hosted customers. Organisations running their own servers must apply the update themselves.
Should you worry if your employer uses ServiceNow?
Probably not if your company uses the cloud-hosted version; the patch arrived automatically. If they run their own copy and haven't applied the update, the system may still be exposed. You don't need to act yourself, but it's worth flagging to whoever runs IT.
Ivanti, which makes tools for managing and visualising company data, patched two flaws in Xtraction. CVE-2026-14902 is a medium-severity open redirect: the software can be tricked into sending a user's browser to a malicious external site, useful for phishing attacks that harvest login credentials. CVE-2026-14903 is a high-severity path traversal, meaning an attacker could read server files the software was never meant to expose. We first covered Xtraction vulnerabilities on 15 July 2026. Ivanti says neither flaw has been exploited.
Fortinet published 11 advisories covering 12 separate vulnerabilities across ten products, including FortiOS, FortiProxy, FortiSIEM, FortiAuthenticator, FortiSandbox and others. The severest bugs sit in FortiAuthenticator and FortiSandbox: unauthenticated remote attackers could retrieve sensitive information or gain access to virtual-machine scanning environments. Given the active ransomware campaigns our July reporting linked to stolen FortiGate credentials, unpatched Fortinet devices deserve immediate attention even when no exploitation is confirmed. Fortinet found no evidence of active exploitation here.
The pattern across all three vendors is the same: patches exist, exploitation hasn't started. That window won't stay open long.
