Fortinet's Patch Release Raises Questions About Undisclosed Risks

Patching in the Shadows of Vulnerability

On July 15, 2026, the cybersecurity landscape witnessed a noteworthy moment when Fortinet, Ivanti, and ServiceNow collectively released patches for 15 vulnerabilities that fell under scrutiny. Amid heightened threats, especially with the increasing prevalence of remote work and cloud infrastructure, the nature and severity of these vulnerabilities deserve a more meticulous examination. ServiceNow's critical remote code execution vulnerability, tracked as CVE-2026-6875, stands out with a staggering CVSS score of 9.5. Such a flaw, which allows for exploitation without authentication, begs the question: how secure are the critical infrastructures that rely on these products?

The Weight of ServiceNow's Vulnerability

ServiceNow's CVE-2026-6875, carrying a CVSS score of 9.5, is particularly alarming given that it pertains to their widely used AI platform. What does it mean when a company like ServiceNow, which operates in a domain densely populated with sensitive data, experiences such a severe vulnerability? The absence of reported exploitation might offer a temporary sense of security, but there is an unsettling complacency that such a vulnerability being discovered but not yet exploited might engender. As businesses increasingly lean on automation and AI-driven services, the implications of such flaws could be catastrophic.

Some may argue that vendors like ServiceNow are quick to broadcast their patching efforts, signaling diligence and responsibility. However, it raises a piercing question: how transparent are these companies in disclosing the full extent of vulnerabilities? The patently high CVSS score indicates a high risk of exploitation; without comprehensive visibility into the foundational architecture of these systems, organizations cannot adequately assess their risk exposure. When critical vulnerabilities are resolved without acknowledging the potential for hidden threats, it can lead to a false sense of security among users who may not fully understand their risk landscape.

Ivanti's Data Visualization Dilemmas

Turning to Ivanti, the company addressed two vulnerabilities in its data visualization tool, Xtraction, identified as CVE-2026-14902 and CVE-2026-14903. These issues present a medium-severity open redirect and a high-severity path traversal vulnerability, respectively. What stands out is Ivanti's unqualified assurance of remediating these vulnerabilities, lacking any mentions of confirmed exploitation in the wild. The lack of reported incidents could suggest a degree of negligence in assessing the vulnerabilities' potential for abuse or an intentional shroud of silence regarding possible past exploits. Is this a sign that the market for exploiting such weaknesses is still evolving or that users should remain vigilant?

Similar to ServiceNow, while Ivanti may laud its proactive patching, a deeper dive into the ramifications of such vulnerabilities reveals unsettling realities. The potential exists for undetected exploitation, where bad actors could leverage these vulnerabilities while organizations operate under the impression that they are secure. Furthermore, these vulnerabilities can serve as indicators of a larger, systemic oversight in focusing on patching rather than transparency and open communication with the users relying on these platforms for critical operations.

Fortinet's Comprehensive Patching Approach

Fortinet issued advisories that cover a staggering 12 vulnerabilities affecting its varied product offerings, such as FortiOS and FortiClient EMS. Among these, the high-severity flaws in FortiAuthenticator and FortiSandbox warrant particular scrutiny due to their potential to allow remote unauthenticated access to sensitive VM information. However, like the others, Fortinet has not reported any exploitation of its vulnerabilities, leaving organizations reliant on their assurances wondering just how often these vulnerabilities go undetected.

This raises essential questions about the governance framework surrounding vulnerability disclosure in the cybersecurity industry. Each vendor's failure to acknowledge known exploitation—even when evidence suggests it may be occurring—leaves a significant gap in organizational preparedness. Patching, while essential, should not be regarded as the endpoint but rather as a component of a broader strategy to mitigate risks stemming from systemic weaknesses in transparency and vulnerability reporting.

Acknowledging the Broader Context

In summary, while the patches released by Fortinet, Ivanti, and ServiceNow demonstrate a commitment to security, they also highlight a troubling trend of opacity within the cybersecurity community. The absence of reported exploitation around these vulnerabilities offers some reassurance, yet it inevitably raises the question of what remains undisclosed. As reliance on these technologies grows, so too does the imperative for vendors to adopt more rigorous transparency and communication practices regarding vulnerabilities.

Ultimately, organizations must approach these patches with a mix of caution and skepticism. Patching is only one part of a larger cybersecurity strategy, and users must remain vigilant in maintaining awareness of underlying risks. Trusting that companies will provide full disclosure is inadequate; organizations must also prioritize their cybersecurity governance frameworks to include rigorous examination of vendor claims and active risk assessments of their dependencies.

This perspective is generated by an AI columnist.

Sources: https://www.securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenow