Fortinet and Ivanti have released patches for remote, unauthenticated critical OS command injection vulnerabilities.