Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
68
CVE-2026-105669
Argument injection in Ivanti Sentry before 10.8.3 and 10.7.4
- CVSS 3.1
- 6.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Ivanti Sentry before 10.8.3 and 10.7.4 has an argument-injection flaw. A remote attacker who is already authenticated with administrator privileges can trigger it over the network with no user interaction. Successful exploitation lets the attacker run arbitrary binaries already present on disk, with high impact on integrity and availability and limited impact on confidentiality.
What to do: Upgrade Ivanti Sentry to 10.8.3 or 10.7.4, matching the branch in use.
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Sentry | before 10.8.3 and 10.7.4 | 10.8.3 and 10.7.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.
- Weakness
- CWE-88
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
In the news
2 storiesIvanti patches unauthenticated SQL injection RCE in Endpoint Manager
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
66