Ivanti has issued important security patches for several of its products, including Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Appliance (CSA), and User Workspace Manager. The updates, announced in November 2026, address serious vulnerabilities that could potentially lead to remote code execution, unauthorized changes to trusted certificates, data breaches, and service interruptions.
Critical Vulnerabilities and Their Impact
Among the disclosed vulnerabilities, two critical issues in Endpoint Manager and CSA pose the greatest risk. Although Ivanti has not observed any active exploitation of these vulnerabilities prior to disclosure, the company emphasizes the necessity of applying patches, especially for services accessible without user authentication.
The most severe flaw, identified as CVE-2026-121653, is an SQL injection vulnerability with a CVSS score of 9.8. It affects the Endpoint Manager Core versions prior to 2024 SU8, potentially allowing remote attackers to execute code without needing authentication. Another issue, CVE-2026-18128, exposes sensitive information by transmitting data in cleartext, affecting versions up to EPM 2024 SU7.
CSA and EPMM Security Concerns
The Cloud Services Appliance (CSA) also contains a critical vulnerability, CVE-2026-121683, with a CVSS score of 9.4. This flaw enables remote attackers to manipulate trusted EPM Core certificate entries without authentication, affecting version 5.0.8 exclusively. Ivanti has addressed this in version 5.0.8.1, while earlier versions remain unaffected.
Further vulnerabilities in Endpoint Manager Mobile (EPMM) highlight risks from unauthorized code execution to system configuration manipulation. Notable issues include CVE-2026-105425, which allows code execution through OS command injection, and other flaws enabling kernel setting alterations and file deletions.
Additional Flaws and Recommended Actions
Additional security concerns in Sentry and User Workspace Manager involve argument injection and cleartext storage vulnerabilities, respectively. Ivanti advises immediate updates to Sentry versions 11.0.0, 10.8.3, and 10.7.4, and to User Workspace Manager version 2026.4, to safeguard against these threats.
Security teams are urged to prioritize patches for unauthenticated vulnerabilities in EPM and CSA, followed by other updates based on system exposure and existing access controls. Despite the absence of known public exploits, administrators should verify version updates and not rely solely on restricted administrative access for security assurance.
For enhanced incident response, integrating threat intelligence into security operations can help swiftly mitigate potential threats. Ivanti’s proactive patch management underscores the importance of staying ahead in cybersecurity defense.
