Critical security flaws in Fortinet and Ivanti products, alongside a targeted phishing campaign, highlight urgent patching needs for global enterprises.

The current cybersecurity landscape is witnessing a concentrated surge of high-severity vulnerabilities across essential enterprise infrastructure. Recent alerts from the Italian National Cybersecurity Agency (ACN) have highlighted a series of critical flaws in widely used network and management tools, specifically targeting Fortinet and Ivanti ecosystems. For business owners and CTOs, these reports signal a period of heightened risk where the window between vulnerability discovery and potential exploitation is narrowing.

Fortinet security flaws and the risk of data exposure

Fortinet, a cornerstone of network security for thousands of global firms, is currently facing several vulnerabilities that could compromise the integrity of corporate perimeters. The alerts identify four specific CVEs, three of which are classified as critical. These flaws primarily affect Fortinet products, including FortiOS and FortiProxy versions prior to 7.6.7.

The technical nature of these vulnerabilities involves authentication bypass, information disclosure, and the bypassing of security features. In practical terms, an attacker exploiting these gaps could gain unauthorized access to sensitive information stored on the affected systems. The impact is not limited to core OS versions; it extends to FortiSandbox (versions 5.0.x and 4.4.x), FortiSandbox Cloud, FortiSandbox PaaS, and even the FortiPAM Chrome Extension. Furthermore, specific versions of FortiMonitorOnSigh (7.2.0 to 7.2.2 and 7.2.4 to 7.2.7) are also flagged as vulnerable.

Ivanti vulnerabilities allow remote code execution

Parallel to the Fortinet alerts, Ivanti has released urgent security updates to address ten vulnerabilities. The severity here is particularly acute, with six flaws labeled as critical and four as high. Unlike simple data leaks, these vulnerabilities could allow a remote attacker—often without the need for authentication—to execute arbitrary code on the target systems.

The scope of the Ivanti threat covers several key management tools:

• Ivanti Neurons for ITSM (both Cloud/SaaS version 2026.2 and various On-Prem versions from 2025.2 to 2026.1)
• Ivanti Sentry (versions R10.8.x, R10.7.x, and R10.6.x)
• Ivanti Endpoint Manager Mobile (versions 12.9.x and 12.8.x)

These flaws facilitate privilege escalation and the bypassing of security restrictions, effectively giving an attacker the keys to the administrative kingdom within the affected environment.

The browser as a primary attack vector

While infrastructure flaws capture the headlines, the endpoint remains the most frequent point of entry. Google has recently deployed a massive update for Chrome to resolve 230 new security vulnerabilities. The scale of this patch is significant, addressing 5 critical and 41 high-severity flaws, including the notable CVE-2026-87491.

Because browsers are the primary interface for almost every business operation, these vulnerabilities represent a systemic risk. A single unpatched browser can serve as the gateway for the very exploits that target the Fortinet or Ivanti systems mentioned above. The sheer volume of vulnerabilities corrected in a single cycle underscores the volatility of modern web rendering engines and the necessity of automated update policies across all corporate workstations.

Phishing tactics evolving through corporate mimicry

Beyond software bugs, the human element remains a critical weakness. A recent phishing campaign has been detected using a sophisticated psychological approach by mimicking the Business Register (Registro Imprese) and Chambers of Commerce. This campaign does not rely on technical exploits but on social engineering and the creation of a false sense of urgency.

The attackers use emails written in slightly imprecise language to lure victims into a fake portal that replicates the official logos and branding of the corporate registry. The goal is to trick business owners into entering sensitive company data. To increase the perceived legitimacy of the scam, the malicious site redirects the user to the actual, legitimate portal only after the data has been stolen. This technique masks the theft, making the user believe they have simply completed a standard administrative update.

The use of official institutional branding combined with a fake urgency context represents a high-risk threat to SMEs that lack dedicated security awareness training.

Mitigation strategies for the modern enterprise

Addressing these threats requires a dual approach: technical remediation and human defense. For the infrastructure vulnerabilities, the primary directive is immediate patching. Following vendor guidelines to update FortiOS, FortiProxy, and Ivanti Neurons is the only way to close the gaps that allow remote code execution and authentication bypass.

On the human side, the phishing campaign highlights the need for continuous education. Organizations should implement training sessions that teach employees to be skeptical of unexpected communications, especially those demanding urgent payments or the update of sensitive corporate data. Verifying the sender's identity through independent channels rather than clicking embedded links is a fundamental habit that can prevent the compromise of corporate credentials.

Global implications for US and UK businesses

For entrepreneurs and IT managers in the USA and UK, these alerts serve as a reminder that cybersecurity is a globalized struggle. While the alerts originated from a European agency, the products involved—Fortinet, Ivanti, and Google Chrome—are ubiquitous in the American and British markets. The systemic impact score of 66.53 associated with these flaws indicates a high level of risk for any organization relying on these stacks.

In the US, where the regulatory environment is shifting toward more stringent reporting requirements for critical infrastructure, failing to patch known CVEs can lead to significant liability and insurance complications. Similarly, UK firms operating under the UK GDPR must ensure that their technical measures are up to date to prevent data breaches that could result in heavy fines. The intersection of these vulnerabilities suggests that a coordinated update cycle is not just a technical preference, but a regulatory necessity to maintain a defensible security posture in the global market.

FAQ

---

Sources: Acn (7) ·