Critical Patches Released for Ivanti, Fortinet, SAP, VMware and n8n: GCC Enterprises Must Act Now
Five major enterprise vendors have released simultaneous patches for critical flaws including unauthenticated RCE, SQL injection, and privilege escalation. With CVSS scores reaching 9.6, GCC security teams should treat this as an immediate patching priority.
IT security professional in a Gulf enterprise operations centre reviewing critical vulnerability patch dashboards for Ivanti, Fortinet, SAP, VMware and n8n
Five major enterprise software vendors have released simultaneous security patches this week, addressing a combined set of critical vulnerabilities with CVSS scores reaching 9.6. Attack vectors include unauthenticated remote code execution, SQL injection, and local privilege escalation. Organisations running any of these platforms across the GCC should treat this as an immediate patching priority.
The timing carries added urgency. As confirmed in Verizon's 2026 Data Breach Investigations Report, AI is now being used by threat actors to shrink the window between patch release and active exploitation from months to hours. Delaying patching on critical enterprise platforms is no longer a measured risk: it is an active exposure.
Ivanti Xtraction
Ivanti has patched CVE-2026-8043 (CVSS 9.6) in Ivanti Xtraction versions prior to 2026.2. The flaw allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, enabling both information disclosure and client-side attacks. Organisations must upgrade to version 2026.2. Full details are available at Ivanti's security portal.
Fortinet: Two Critical Flaws
CVE-2026-44277 (CVSS 9.1) affects FortiAuthenticator. An improper access control flaw may allow an unauthenticated attacker to execute unauthorised code via crafted requests. Fixed in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3.
CVE-2026-26083 (CVSS 9.1) affects FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. A missing authorisation vulnerability in the web UI may allow unauthenticated remote code execution via HTTP requests. Fixed in FortiSandbox 4.4.9 and 5.0.2, FortiSandbox Cloud 5.0.6, and FortiSandbox PaaS 4.4.9 and 5.0.2. Full advisories are available at Fortinet's PSIRT page.
SAP: SQL Injection and Authentication Bypass
CVE-2026-34260 (CVSS 9.6) is an SQL injection flaw in SAP S/4HANA. A low-privileged authenticated attacker can inject malicious SQL via user-controlled input, exposing sensitive database information and potentially causing application downtime. For GCC enterprises running SAP S/4HANA across finance and supply chain operations, this flaw represents a direct data integrity risk.
CVE-2026-34263 (CVSS 9.6) is a missing authentication check in SAP Commerce Cloud. An unauthenticated user can perform malicious configuration uploads and code injection, resulting in arbitrary server-side code execution. This vulnerability is particularly relevant to regional e-commerce and retail operations. The SAP SQL injection class of attack is consistent with active exploitation patterns seen across the Gulf, where web-facing platforms remain a primary target for injection-based attacks. Apply the May 2026 Security Patch Day updates immediately via SAP's Security Patch Day page.
VMware Fusion
CVE-2026-41702 (CVSS 7.8) in VMware Fusion is a time-of-check time-of-use vulnerability that allows a local non-administrative user to escalate privileges to root. Fixed in VMware Fusion version 26H1. See Broadcom's security advisories for full details.
n8n: Five Critical RCE Vulnerabilities
n8n has patched five remote code execution vulnerabilities, all rated CVSS 9.4. CVE-2026-42231 and CVE-2026-42232 arise from prototype pollution via XML parsing. CVE-2026-44791 is a bypass for CVE-2026-42232. CVE-2026-44789 exploits an unvalidated pagination parameter. CVE-2026-44790 allows CLI flag injection on the Git node's Push operation, enabling arbitrary file reads and full server compromise. Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1.
The privilege escalation and chained exploitation techniques seen across this week's disclosures mirror the attack patterns detailed in recent analysis of chained CVE exploits targeting enterprise environments, where attackers chain multiple lower-severity flaws to achieve full system compromise.
Patching Priority for GCC Enterprises
Prioritise the Fortinet FortiAuthenticator and FortiSandbox fixes first given the unauthenticated attack path, followed by SAP Commerce Cloud and Ivanti Xtraction. Address VMware Fusion and n8n in the next patching cycle.
For broader context on enterprise vulnerability management in the GCC, our coverage of managed detection and response in the Gulf and the eight key cybersecurity risks facing GCC enterprises in 2026 provide essential reading for regional security leaders. Understanding the broader operational resilience landscape across the Middle East is equally important for organisations managing complex patch cycles across hybrid environments.
Patch management guidance for regulated entities is published by the UAE Cyber Security Council and Saudi Arabia's National Cybersecurity Authority.
Omar Al-Hakeem
Senior Cyber Threat Analyst | MENA RegionOmar Al-Hakeem is a cybersecurity researcher specializing in threat intelligence, ransomware trends, and nation-state activity across the Middle East and North Africa. With over 12 years of experience in SOC operations and incident response, he provides deep technical breakdowns of emerging attacks and regional cyber risks. At MENA Cyber Wire, Omar focuses on real-world threat analysis and actionable defense strategies for enterprises and startups.