Citrix and Ivanti Address Multiple Critical Vulnerabilities
Citrix and Ivanti have released patches for a combined total of 19 vulnerabilities, including several critical and high-severity flaws that could lead to remote code execution and system compromise.
Citrix and Ivanti have jointly announced the release of security updates to address a significant number of vulnerabilities affecting their respective product lines. In total, 19 distinct security flaws have been patched, with a notable concentration of critical and high-severity issues that pose a substantial risk to organizations.
Ivanti, in particular, has resolved 13 vulnerabilities across five of its products. Two critical-severity defects were identified in its Cloud Services Application (CSA) and Endpoint Manager (EPM). The CSA vulnerability, tracked as CVE-2026-121683 with a CVSS score of 9.4, is a missing authentication issue that could permit unauthenticated remote attackers to manipulate certificate entries. This flaw is fixed in CSA version 5.0.8.1, though Ivanti notes that deployments using a Dual NIC configuration are not externally exploitable.
The critical vulnerability in Endpoint Manager (EPM), identified as CVE-2026-121653 and carrying a CVSS score of 9.8, is an SQL injection bug. This severe flaw could enable remote code execution (RCE) without requiring any form of authentication. The fix is included in EPM version 2024 SU8, which also addresses a medium-severity vulnerability related to the cleartext transmission of sensitive information, exploitable via Man-in-the-Middle (MitM) attacks.
Further patching by Ivanti includes four vulnerabilities in Sentry, one of which is a high-severity RCE flaw (CVE-2026-105425). This same RCE vulnerability was also patched in Endpoint Manager Mobile (EPMM), alongside five other medium-severity issues. Additionally, a medium-severity defect in User Workspace Manager (UWM) was addressed. Ivanti has stated that it has no evidence of any of these vulnerabilities being actively exploited in the wild.
On the Citrix front, updates have been released for six security defects in XenServer. One of these, CVE-2026-102705, is a high-severity bug that could allow attackers to infer the Pool Secret, potentially leading to a compromise of the host system. The remaining five XenServer vulnerabilities could result in privilege escalation or allow administrators of any role to terminate tasks initiated by other roles.
In addition to the XenServer fixes, Citrix has also deployed updates to mitigate several AMD CPU vulnerabilities. These vulnerabilities could potentially allow guest virtual machines to compromise the host system or infer the active memory content of other virtual machines running on the same hardware.
Given the critical nature of several of these vulnerabilities, particularly those enabling remote code execution and host compromise, organizations utilizing Ivanti and Citrix products are strongly advised to apply the released patches as soon as possible. Prompt remediation is crucial to prevent potential exploitation and maintain the security posture of affected systems.