Citrix and Ivanti Release Security Patches
In a significant cybersecurity development, Citrix and Ivanti have announced the release of patches for a total of 19 vulnerabilities discovered in their respective products. This includes several critical and high-severity issues that had been identified by security researchers.
Ivanti Addresses Critical Security Flaws
Ivanti has addressed 13 vulnerabilities across five of its key products, focusing particularly on two critical flaws found in Cloud Services Application (CSA) and Endpoint Manager (EPM). The CSA vulnerability, identified as CVE-2026-121683 with a CVSS score of 9.4, involves a missing authentication mechanism that could potentially allow unauthorized remote attackers to manipulate trusted EPM Core certificate entries.
Ivanti has released CSA version 5.0.8.1 to address this issue. Notably, configurations using a Dual NIC setup are not subject to external exploitation, according to Ivanti’s reports. The critical flaw in EPM, labeled CVE-2026-121653 with a CVSS score of 9.8, is a SQL injection vulnerability capable of allowing remote code execution without needing authentication.
Additional Vulnerabilities Resolved
EPM version 2024 SU8 resolves the critical SQL injection issue and also fixes a medium-severity problem related to the cleartext transmission of sensitive information, which could be exploited through man-in-the-middle (MitM) attacks. Furthermore, Ivanti has patched four vulnerabilities in Sentry, including a high-severity remote code execution flaw tracked as CVE-2026-105425. This bug, along with five other medium-severity issues, was also patched in Endpoint Manager Mobile (EPMM).
In addition to these, Ivanti handled a medium-severity vulnerability in User Workspace Manager (UWM). The company reassures users that there is no evidence of these vulnerabilities being actively exploited in the wild.
Citrix Enhances XenServer Security
Citrix has also rolled out security updates addressing six vulnerabilities in XenServer. Among these, CVE-2026-102705 is a high-severity issue that could enable attackers to deduce the Pool Secret, potentially compromising the host system. The other five vulnerabilities could lead to privilege escalation or allow users with administrative roles to interrupt tasks of other roles.
Moreover, Citrix has released updates for XenServer to mitigate several vulnerabilities in AMD CPUs, which could potentially allow guest virtual machines to access the host system or infer memory content from another VM.
These patches underscore the ongoing efforts by Citrix and Ivanti to strengthen their cybersecurity defenses and protect users from significant threats.
