Critical CVSS 9.8 Security news
Ivanti patches 13 flaws: critical SQL injection in Endpoint Manager and missing authentication in CSA
On Tuesday 10 November 2026 Ivanti shipped fixes for five products: Endpoint Manager (EPM), Cloud Services Application (CSA), Endpoint Manager Mobile (EPMM), Sentry and User Workspace Manager. Two of the 13 flaws are critical, and both can be exploited without logging in: a SQL injection in the EPM Core that leads to code execution, and missing authentication in CSA that lets anyone add or delete trusted EPM Core certificates. Ivanti says none is known to be exploited. Here is what to patch first.
Key points
- Who is affected: admins of Ivanti Endpoint Manager (formerly LANDesk), its Cloud Services Application gateway, EPMM mobile device management, the Sentry gateway and User Workspace Manager.
- Most dangerous: CVE-2026-121653 (CVSS 9.8) – SQL injection in the Endpoint Manager Core lets an unauthenticated attacker run code. Fixed in 2024 SU8. The EPM Core has admin-level reach into every managed machine.
- CVE-2026-121683 (CVSS 9.4) – missing authentication in Cloud Services Application 5.0.8 lets an unauthenticated attacker add and delete trusted EPM Core certificate entries.
- The other 11 flaws are rated High or Medium and mostly need an admin account – the worst is OS command injection in Sentry and EPMM (CVE-2026-105425, CVSS 7.2). Ivanti has seen no exploitation and published no indicators.
Vulnerabilities: CVE-2026-121653, CVE-2026-121683, CVE-2026-105425
What happened
On Tuesday 10 November 2026, as part of its monthly patch release, Ivanti published advisories for five products. NVD gained 13 CVE records for them, two of them critical:
| CVE | Product | Bug class | CVSS 3.1 | Login needed |
|---|---|---|---|---|
| CVE-2026-121653 | Endpoint Manager (Core) | SQL injection → code execution (CWE-89) | 9.8 | no |
| CVE-2026-121683 | Cloud Services Application | missing authentication (CWE-306) | 9.4 | no |
| CVE-2026-105425 | Sentry, EPMM | OS command injection (CWE-78) | 7.2 | yes, admin |
| CVE-2026-18128 | Endpoint Manager (agent) | cleartext transmission (CWE-319) | 6.8 | no (attacker in the middle) |
The remaining nine flaws are rated Medium (CVSS 4.9–6.7) and, with one exception (UWM), need an admin account. Ivanti says it is not aware of exploitation and that no other Ivanti products are affected.
Technical details
These details come from the NVD records, which Ivanti filled in as the CVE numbering authority. Ivanti's advisory portal only renders with JavaScript, and no third-party analysis has been published yet. We do not publish exploitation guidance.
- Endpoint Manager Core (CVE-2026-121653, CVSS 9.8): a SQL injection in the EPM Core before 2024 SU8 lets a remote, unauthenticated attacker run code. The vector
AV:N/AC:L/PR:N/UI:Nmeans a network attack with no account and no user interaction. The EPM Core holds admin-level access to managed machines, so taking it over can hand an attacker the whole endpoint fleet. - Cloud Services Application (CVE-2026-121683, CVSS 9.4): CSA 5.0.8 lacks authentication on the function that manages trusted EPM Core certificates. An unauthenticated attacker can add and delete entries. The NVD record contradicts itself on versions (the description names 5.0.8 as vulnerable, while the machine-readable data marks it unaffected), so confirm the fixed build in Ivanti's advisory.
- Sentry and EPMM (CVE-2026-105425, CVSS 7.2): OS command injection that requires an admin account. It matters most when combined with stolen credentials.
- Endpoint Manager agent (CVE-2026-18128, CVSS 6.8): agents before 2024 SU8 send some traffic over plain HTTP, which an attacker in the middle can read and modify.
- The rest: EPMM – setting Linux kernel parameters as root (CVE-2026-105426), disabling HTTPS (CVE-2026-105427), deleting files (CVE-2026-107404), denial of service (CVE-2026-107405) and leaking users' personal data (CVE-2026-83528); Sentry – running on-disk binaries (CVE-2026-105669), denial of service (CVE-2026-123179) and path traversal (CVE-2026-123181); UWM – a session token stored in cleartext (CVE-2026-105813).
Who is affected
| Product | Vulnerable | Fixed |
|---|---|---|
| Endpoint Manager (CVE-2026-121653, CVE-2026-18128) | before 2024 SU8 | 2024 SU8 |
| Cloud Services Application (CVE-2026-121683) | 5.0.8 | see Ivanti's advisory |
| Sentry (CVE-2026-105425) | before 11.0.0, 10.8.3, 10.7.4 | 11.0.0, 10.8.3, 10.7.4 |
| Endpoint Manager Mobile (CVE-2026-105425) | before 12.11.0.0, 12.10.0.1, 12.9.0.3 | 12.11.0.0, 12.10.0.1, 12.9.0.3 |
| User Workspace Manager (CVE-2026-105813) | before 2026.4 | 2026.4 |
The fixed EPMM and Sentry versions come from the CVE-2026-105425 record; check the advisories for the other EPMM and Sentry flaws.
How to tell if you were compromised
Ivanti has not published indicators of compromise. What we suggest watching (our own advice, not Ivanti guidance):
- EPM Core: unusual requests to the Core's web services from outside your admin ranges, SQL errors in IIS and SQL Server logs, new processes spawned by the web server (
w3wp.exe) or the database (sqlservr.exe), new software distribution jobs and new console admins. - CSA: changes to the trusted EPM Core certificate list that you did not make.
- Sentry and EPMM: admin logins from unfamiliar addresses and configuration changes outside maintenance windows.
If Ivanti or a CERT publishes indicators, you can pull them out of the report with our IOC extractor. You can recalculate the vectors in the CVSS calculator.
What to do
- Endpoint Manager: upgrade the Core to 2024 SU8. Until then, allow access to the Core only from managed machines and admin hosts; it should not be reachable from the internet.
- Cloud Services Application: upgrade to the build listed in Ivanti's advisory, then review the trusted EPM Core certificate list.
- Sentry (11.0.0 / 10.8.3 / 10.7.4) and EPMM (12.11.0.0 / 12.10.0.1 / 12.9.0.3): upgrade in your next maintenance window and keep admin interfaces on the internal network.
- User Workspace Manager: upgrade to 2026.4.
- Review who holds admin accounts in EPMM and Sentry, and turn on multi-factor authentication – most of the remaining flaws need one.
Timeline
Updates
- 11 Nov 2026 – first version of this article.
FAQ
Are these flaws being exploited?
In its 10 Nov 2026 update Ivanti says it has no evidence of exploitation, and none of the flaws is in the CISA KEV catalog. CISA's SSVC assessment for CVE-2026-105425 lists exploitation as "none". Attackers have targeted Ivanti products for years, though, so we would fix the unauthenticated bugs scored above 9 within days.
Our Endpoint Manager is internal only. Is this urgent?
Less urgent than an internet-facing system, but the EPM Core is a prize: it pushes software and commands to every managed machine. Anyone who gets onto the internal network – after a phishing email, say – could use the unauthenticated SQL injection to take over the Core and, with it, endpoint management. Patch in your next maintenance window.
What is Cloud Services Application, and why does the certificate bug matter?
CSA is the gateway that lets machines outside the corporate network reach the Endpoint Manager Core. According to NVD, an unauthenticated attacker can add and delete trusted EPM Core certificate entries. Ivanti does not describe further impact; the CVSS vector rates integrity and availability impact as high (I:H/A:H), so an attacker could undermine trust between the gateway and the Core or cut the connection.
Does this affect Ivanti Connect Secure?
No. Ivanti says the November flaws do not affect any of its other products. The actively exploited Connect Secure flaws from November 2026 are a separate story.
Sources
- Ivanti – November 2026 Security Update (10 Nov 2026)
- Ivanti – Security Advisory Ivanti Endpoint Manager (EPM) November 2026
- Ivanti – Security Advisory Ivanti CSA (CVE-2026-121683)
- NVD – CVE-2026-121653 (Ivanti Endpoint Manager, SQL injection)
- NVD – CVE-2026-121683 (Ivanti Cloud Services Application)
- NVD – CVE-2026-105425 (Ivanti Sentry and EPMM, command injection)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.