Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
68
CVE-2026-121683
Missing authentication in Ivanti Cloud Services Application 5.0.8
- CVSS 3.1
- 9.4 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Ivanti Cloud Services Application 5.0.8 does not require authentication for trusted EPM Core certificate management. A remote attacker can add or delete arbitrary trusted EPM Core certificate entries without logging in or user interaction. Anyone running that version is affected. No fixed version is stated.
What to do: Apply Ivanti's update for CVE-2026-121683. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Ivanti Cloud Services Application | 5.0.8 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- Weakness
- CWE-306
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
In the news
3 storiesCitrix and Ivanti patch 19 flaws, including critical RCE bugs
Ivanti reports no evidence of exploitation; CSA 5.0.8.1 and Endpoint Manager 2024 SU8 fix the two critical defects.
66
Ivanti patches unauthenticated SQL injection RCE in Endpoint Manager
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
66