Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
68
CVE-2026-123181
Path traversal in Ivanti Sentry before 10.7.4 and 10.8.3
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A path traversal flaw in Ivanti Sentry lets a remote attacker who already has administrative privileges create arbitrary directories and files with root privileges. No further user interaction is required. Sentry releases before 10.7.4 and before 10.8.3 are affected.
What to do: Upgrade Ivanti Sentry to 10.7.4 or 10.8.3.
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Sentry | before 10.7.4 and 10.8.3 | 10.7.4 and 10.8.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
In the news
2 storiesIvanti patches unauthenticated SQL injection RCE in Endpoint Manager
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
66