Citrix and Ivanti patch 19 flaws, including critical RCE bugs
Original title: Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Ivanti reports no evidence of exploitation; CSA 5.0.8.1 and Endpoint Manager 2024 SU8 fix the two critical defects.
Citrix and Ivanti released patches for 19 vulnerabilities, including critical flaws in Ivanti Cloud Services Application and Endpoint Manager. The CSA bug can let unauthenticated remote attackers add or delete trusted EPM Core certificate entries, while the EPM SQL injection can lead to unauthenticated remote code execution. Citrix fixed six XenServer defects, including one that could expose the Pool Secret, and mitigated several AMD CPU issues. Ivanti says it has no evidence these flaws are being exploited.
Unconfirmed: Ivanti reports no exploitation evidence; the article does not state whether the Citrix flaws have been exploited.
- CVE-2026-121683 in CSA has a CVSS score of 9.4 and is fixed in 5.0.8.1.
- Dual-NIC CSA deployments cannot be exploited externally, Ivanti says.
- CVE-2026-121653 in Endpoint Manager has CVSS 9.8 and is fixed in 2024 SU8.
- CVE-2026-105425 is a high-severity RCE bug fixed in Sentry and EPMM.
- CVE-2026-102705 could let attackers infer a XenServer Pool Secret and compromise the host.
Impact: Unauthenticated remote code execution and certificate-trust changes
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Cloud Services Application | — | 5.0.8.1 |
| Ivanti Endpoint Manager | — | 2024 SU8 |
| Ivanti Sentry | — | — |
| Ivanti Endpoint Manager Mobile | — | — |
| Citrix XenServer | — | — |
- 1.Update Ivanti CSA to 5.0.8.1 and Endpoint Manager to 2024 SU8.
- 2.Apply the Ivanti Sentry, EPMM and User Workspace Manager patches.
- 3.Install Citrix XenServer security updates, including AMD CPU mitigations.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102705 | — | — | — | ||
| CVE-2026-105425 | OS command injection in Ivanti Sentry and EPMM (admin) | 7.2 | — | ||
| CVE-2026-121653 | Unauthenticated SQL injection to RCE in Ivanti Endpoint Manager | 9.8 | — | ||
| CVE-2026-121683 | Missing authentication in Ivanti Cloud Services Application 5.0.8 | 9.4 | — |
From the original article
1 min read at securityweek.com
Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts. The post Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.