Ivanti Patches Multiple Critical Vulnerabilities Across Endpoint Management Suite
Ivanti has released urgent security updates to address a series of critical vulnerabilities affecting its Endpoint Manager, EPMM, Sentry, CSA, and User Workspace Manager products.
Ivanti has issued a wave of security updates to patch several vulnerabilities discovered across its product suite, including Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Application (CSA), and User Workspace Manager. The disclosures, made in November 2026, highlight flaws that could permit remote code execution, unauthorized modification of trusted certificates, data exposure, and service disruptions. The company stated it was unaware of any active exploitation of these vulnerabilities prior to their public disclosure, with the issues having been reported through its responsible disclosure program.
The most critical vulnerability, CVE-2026-121653, carries a CVSS score of 9.8 and affects Ivanti Endpoint Manager Core versions prior to 2024 SU8. This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary code on the affected systems. This follows previous SQL injection flaws in Endpoint Manager that also exposed management servers to code execution risks. Additionally, CVE-2026-18128, rated CVSS 6.8, impacts Endpoint Manager and allows attackers to read and alter HTTP traffic by intercepting data transmitted in cleartext between systems. Both vulnerabilities are fixed in EPM 2024 SU8, available via the Ivanti License System.
Another high-severity flaw, CVE-2026-121683, affects Cloud Services Application (CSA) version 5.0.8, with a CVSS score of 9.4. This vulnerability, which bypasses authentication, enables remote attackers to add or delete arbitrary trusted certificate entries for the EPM Core. This issue is distinct from previously disclosed CSA vulnerabilities requiring different patches. The fix is available in CSA version 5.0.8.1, while versions 5.0.7 and earlier are not affected by this specific flaw. Ivanti recommends applying the update, noting that a dual network interface configuration can limit exposure to internal networks.
The EPMM advisory details six vulnerabilities, including CVE-2026-105425 (CVSS 7.2), which allows remote attackers with administrator privileges to execute operating system commands. This same vulnerability also affects Sentry, necessitating updates for both products if deployed. Other EPMM vulnerabilities allow for changes to Linux kernel settings, disabling of Apache HTTPS services, deletion of arbitrary files, and exposure of protected personal information. Fixed releases for EPMM include versions 12.11.0.0, 12.10.0.1, and 12.9.0.3.
Sentry also faces vulnerabilities, notably CVE-2026-105669, an argument injection flaw enabling remote administrators to execute existing disk binaries. CVE-2026-123179 allows local authenticated attackers to cause denial of service via the Tomcat shutdown listener, and CVE-2026-123181 permits remote administrators to create arbitrary files and directories with root privileges. Patched Sentry versions include 11.0.0, 10.8.3, and 10.7.4.
User Workspace Manager addresses CVE-2026-105813, a medium-severity flaw related to cleartext storage, where a local authenticated attacker could access another user's session data. The recommended update is UWM 2026.4, accessible through Ivanti's licensing system.
Security teams are advised to prioritize patching the unauthenticated vulnerabilities in EPM and CSA due to their high severity and potential for remote exploitation. Subsequent updates should be scheduled based on product exposure and existing access controls. While Ivanti has not provided specific indicators of compromise due to the lack of known exploitation, administrators should verify installed versions post-patching and avoid relying solely on restricted administrative access as a security measure.