# Critical RCE Flaws Patched Across SAP, Fortinet, VMware, Ivanti, and n8n in Major Security Update


## The Threat


A coordinated wave of security patches has arrived for critical vulnerabilities affecting enterprise software across cloud, on-premises, and hybrid infrastructure. The advisory patch set includes remote code execution (RCE) flaws in SAP, Fortinet, n8n, and privilege escalation issues in VMware Fusion—some of which can be exploited without authentication, posing an immediate risk to organizations worldwide.


The vulnerabilities span infrastructure management, enterprise resource planning, authentication systems, and automation platforms. Most concerning are the unauthenticated RCE flaws in Fortinet FortiAuthenticator and FortiSandbox, which could allow attackers to gain immediate code execution on critical security infrastructure. Meanwhile, SAP's missing authentication check in Commerce Cloud (CVE-2026-34263) bypasses the entire authentication layer, enabling attackers to inject code and execute arbitrary commands before any credential validation occurs.


The breadth of affected vendors—including net-new automation tools like n8n—suggests that defenders face a complex patching landscape. Organizations running multiple products from this list face compounding exposure, particularly in environments where legacy systems connect to modern cloud automation. N8n's prototype pollution flaws, while requiring authenticated workflow access, are especially dangerous in multi-tenant or externally-accessible instances where compromised workflows could become a beachhead for lateral movement across the platform.


## Severity and Impact


| CVE | Product | CVSS Score | CWE | Attack Vector | Auth Required |

|---------|-----------|---|---|---|---|

| CVE-2026-8043 | Ivanti Xtraction | 9.6 | CWE-434 (Unrestricted Upload) | Network | Authenticated |

| CVE-2026-44277 | Fortinet FortiAuthenticator | 9.1 | CWE-284 (Improper Access Control) | Network | None |

| CVE-2026-26083 | Fortinet FortiSandbox / Cloud / PaaS | 9.1 | CWE-862 (Missing Authorization) | Network | None |

| CVE-2026-34260 | SAP S/4HANA | 9.6 | CWE-89 (SQL Injection) | Network | Authenticated (Low-Privilege) |

| CVE-2026-34263 | SAP Commerce Cloud | 9.6 | CWE-287 (Improper Authentication) | Network | None |

| CVE-2026-41702 | VMware Fusion | 7.8 | CWE-367 (TOCTOU) | Local | Local (Non-Admin) |

| CVE-2026-42231 | n8n | 9.4 | CWE-1321 (Prototype Pollution) | Network | Authenticated |

| CVE-2026-42232 | n8n | 9.4 | CWE-1321 (Prototype Pollution) | Network | Authenticated |


## Affected Products


Ivanti Xtraction

  • Versions before 2026.2

    • Fortinet FortiAuthenticator

  • Versions before 6.5.7, 6.6.9, and 8.0.3

    • Fortinet FortiSandbox (On-Premises)

  • Versions before 4.4.9 and 5.0.2

    • Fortinet FortiSandbox Cloud

  • Versions before 5.0.6

    • Fortinet FortiSandbox PaaS

  • Versions before 4.4.9 and 5.0.2

    • SAP S/4HANA

  • All currently supported versions (SQL injection requiring valid credentials)

    • SAP Commerce Cloud

  • Affected configurations with improper rule ordering

    • VMware Fusion

  • Versions before 26H1

    • n8n

  • Versions before 1.123.32, 2.17.4, and 2.18.1

    • ## Mitigations


    Immediate Actions (Critical Priority):

  • Apply patches immediately for Fortinet FortiAuthenticator and FortiSandbox products, as these allow unauthenticated RCE
  • Upgrade SAP Commerce Cloud configurations and isolate affected instances from untrusted networks during patching
  • Prioritize n8n patching in internet-facing or multi-tenant deployments where users can create workflows
  • Update VMware Fusion to version 26H1 on all endpoints, particularly development and test systems

    • Network Segmentation:

  • Restrict network access to Fortinet FortiAuthenticator, FortiSandbox, and SAP systems from untrusted networks
  • Implement zero-trust access controls for authentication infrastructure
  • Segment automation platform (n8n) instances from direct internet access; require VPN or IP allowlisting

    • Compensating Controls:

  • Monitor Ivanti Xtraction systems for unusual file access patterns and HTML writes to web directories
  • Enable detailed logging on SAP systems to detect SQL injection attempts before patching
  • Implement application-level input validation and parameterized queries as temporary mitigations for SAP S/4HANA

    • Vendor Patch Status:

  • Ivanti: Patches available for Xtraction version 2026.2 and later
  • Fortinet: All fixes released (check specific version numbers above)
  • SAP: Patches available for S/4HANA and Commerce Cloud
  • VMware: Fusion 26H1 released
  • n8n: Updates released across three supported branches

    • ## References


  • [Ivanti Security Advisory](https://www.ivanti.com/security)
  • [Fortinet FortiAuthenticator CVE-2026-44277](https://www.fortinet.com/psirt)
  • [Fortinet FortiSandbox CVE-2026-26083](https://www.fortinet.com/psirt)
  • [SAP S/4HANA CVE-2026-34260 & CVE-2026-34263](https://www.sap.com/products/security.html)
  • [VMware Fusion CVE-2026-41702](https://www.broadcom.com/support/security-advisories)
  • [n8n Security Advisories](https://n8n.io/security)
  • [NIST NVD Database](https://nvd.nist.gov)

    • ---


    ## HackWire Analysis


    This patch batch reveals a critical vulnerability pattern: unauthenticated RCE in authentication and security infrastructure itself. When Fortinet FortiAuthenticator—the security layer protecting enterprise networks—can be compromised without credentials, the entire perimeter collapses. Similarly, SAP Commerce Cloud's missing authentication check means attackers can inject code before any identity verification occurs.


    What's particularly concerning is the convergence of legacy enterprise software (SAP, Fortinet, VMware) with modern automation platforms (n8n). Organizations building hybrid architectures that connect legacy ERP systems to cloud automation tools now face cascading risks. A compromised n8n instance with workflow creation permissions could become a bridge into SAP systems. A breached Fortinet authenticator could become the pivot point for stealing API tokens used by automation.


    The VMware Fusion TOCTOU bug, while lower severity, highlights another troubling trend: endpoint security through hypervisor isolation is increasingly complex, and race conditions in privilege escalation are harder to audit than traditional vulnerabilities. Developers may not recognize that their SETUID binaries contain timing windows exploitable by local users.


    For defenders: Treat this as a complete patch event—apply all fixes in sequence rather than selectively. Fortinet and SAP must be prioritized for internet-facing instances; n8n for multi-user deployments. If you run automation orchestration connected to enterprise systems, audit workflow permissions immediately to ensure only trusted users can modify them.


    The broader lesson: authentication infrastructure and automation platforms deserve the same security rigor as perimeter defenses. A gap in either becomes a systemic risk.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)