Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Canada flags Ivanti CSA and Endpoint Manager flaws now patched

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ivanti has patched critical CSA and Endpoint Manager flaws that Canada flagged on November 10, with no known exploitation.

On November 10, 2026, the Canadian Centre for Cyber Security issued AV26-1141 covering Ivanti Endpoint Manager at or before 2024 SU7 and Cloud Services Application 5.0.8, including CVE-2026-121683, and told administrators to apply updates when available. SecurityWeek reported the next day that Ivanti fixed the CSA defect in 5.0.8.1 and an Endpoint Manager SQL injection in 2024 SU8. CVE-2026-121683, scored 9.4, can let unauthenticated remote attackers add or delete trusted EPM Core certificate entries; Ivanti says dual-NIC CSA deployments cannot be exploited externally. CVE-2026-121653, scored 9.8, can lead to unauthenticated remote code execution. Ivanti says it has no evidence the flaws are being exploited. The Cyber Centre alert did not name fixed builds.

Key facts
  • AV26-1141, dated November 10, 2026, covers Endpoint Manager and CSA.
  • CSA 5.0.8 is affected by CVE-2026-121683, fixed in 5.0.8.1.
  • Endpoint Manager through 2024 SU7 is affected; CVE-2026-121653 is fixed in 2024 SU8.
  • Ivanti reports no evidence these flaws are being exploited.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Cyber Centre issues AV26-1141 on Ivanti EPM and CSA · Canadian Centre for Cyber Security
  2. Nov 11, 2026SecurityWeek reports CSA 5.0.8.1 and EPM 2024 SU8 fixes · SecurityWeek

What each outlet adds

beyond the shared facts
  • Canadian Centre for Cyber SecurityNames AV26-1141, affected ranges, and no fixed build.
  • SecurityWeekAdds CVSS scores, fix versions, impact, and no known exploitation.
CVEs
CVE-2026-121683CVE-2026-121653CVE-2026-105425CVE-2026-102705
Vendors
IvantiCitrix
Products
Cloud Services ApplicationEndpoint ManagerSentryEndpoint Manager MobileUser Workspace ManagerXenServer
Organizations
Canadian Centre for Cyber Security

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Canadian Centre for Cyber SecurityFirst report

    Ivanti Endpoint Manager and CSA have new vulnerabilities

    Canada's Cyber Centre points to Ivanti advisories, including CVE-2026-121683 in CSA 5.0.8, and says to apply updates when available.

  2. · 3d ago SecurityWeek

    Citrix and Ivanti patch 19 flaws, including critical RCE bugs

    Ivanti reports no evidence of exploitation; CSA 5.0.8.1 and Endpoint Manager 2024 SU8 fix the two critical defects.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-102705
———
CVE-2026-105425
OS command injection in Ivanti Sentry and EPMM (admin)
7.2—
CVE-2026-121653
Unauthenticated SQL injection to RCE in Ivanti Endpoint Manager
9.8—
CVE-2026-121683
Missing authentication in Ivanti Cloud Services Application 5.0.8
9.4—