Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
Original title: Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
Ivanti released November 2026 updates for Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Application, and User Workspace Manager. The highest-risk issues are unauthenticated SQL injection code execution in Endpoint Manager and missing authentication in CSA 5.0.8 that can add or delete trusted certificate entries. Other flaws cover cleartext traffic, administrator command or argument injection, file changes, information exposure, and denial of service. Ivanti said it was not aware of customer exploitation before disclosure and did not provide vulnerability-specific indicators.
Unconfirmed: Ivanti said it knew of no customer exploitation before disclosure; that is the vendor’s statement.
- Endpoint Manager 2024 SU7 and earlier is fixed in 2024 SU8, including CVE-2026-18128.
- CSA 5.0.8 only is affected by CVE-2026-121683; 5.0.8.1 fixes it, and 5.0.7 and earlier are not.
- EPMM fixes include 12.11.0.0, 12.10.0.1, and 12.9.0.3; CVE-2026-105425 also affects Sentry.
- Sentry fixes include 11.0.0, 10.8.3, and 10.7.4; User Workspace Manager fix is 2026.4.
- A dual-interface CSA setup can limit exposure, but Ivanti still says to install the update.
Impact: Unauthenticated code execution and trusted-certificate changes
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Endpoint Manager | 2024 SU7 and earlier; Core before 2024 SU8 | 2024 SU8 |
| Ivanti Cloud Services Application | 5.0.8 only | 5.0.8.1 |
| Ivanti Endpoint Manager Mobile | — | 12.11.0.0, 12.10.0.1, and 12.9.0.3 |
| Ivanti Sentry | — | 11.0.0, 10.8.3, and 10.7.4 |
| Ivanti User Workspace Manager | — | 2026.4 |
- 1.Install Endpoint Manager 2024 SU8 and CSA 5.0.8.1 before the other updates.
- 2.Update EPMM, Sentry, and User Workspace Manager to the listed fixed releases.
- 3.Confirm installed versions after patching; do not rely on restricted admin access instead.
- CVEs
- CVE-2026-121653CVE-2026-18128CVE-2026-121683CVE-2026-105425CVE-2026-105426CVE-2026-105427CVE-2026-107404CVE-2026-83528CVE-2026-107405CVE-2026-105669CVE-2026-123179CVE-2026-123181CVE-2026-105813
- Vendors
- Ivanti
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105425+2 related CVEs | OS command injection in Ivanti Sentry and EPMM (admin) | 7.2 group max | — | ||
CVE-2026-121653+2 related CVEs | Unauthenticated SQL injection to RCE in Ivanti Endpoint Manager | 9.8 group max | — | ||
CVE-2026-107405+3 related CVEs | Local DoS via exposed function in Ivanti EPMM | 5.5 group max | — | ||
| CVE-2026-105813 | Cleartext session-token storage in Ivanti UWM before 2026.4 | 6.3 | — | ||
| CVE-2026-121683 | Missing authentication in Ivanti Cloud Services Application 5.0.8 | 9.4 | — | ||
| CVE-2026-123179 | Local DoS from insecure init in Ivanti Sentry shutdown listener | 5.5 | — |
From the original article
3 min read at cybersecuritynews.com
Ivanti has released security updates for Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Application, and User Workspace Manager. The November 2026 disclosures cover flaws that could allow remote code execution, changes to trusted certificates, data exposure, and service disruption. Two critical vulnerabilities in Endpoint Manager and CSA present the highest risks.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.