Ivanti fixes critical SQL injection and certificate flaws

Ivanti issued five security advisories on 10 November 2026, addressing 13 vulnerabilities across five products: Endpoint Manager (EPM), Cloud Services Application (CSA), EPMM, Sentry and User Workspace Manager (UWM). Ivanti says there is no known exploitation at the time of disclosure, and that none of the 13 CVEs is listed in the US CISA Known Exploited Vulnerabilities catalog.

The most severe finding is CVE-2026-121653, a CVSS 9.8 SQL injection in the EPM Core that Ivanti states can lead to remote unauthenticated code execution. A second critical flaw, CVE-2026-121683 (CVSS 9.4), exists in CSA 5.0.8 and allows an unauthenticated attacker to add or delete arbitrary trusted EPM Core certificate entries. Ivanti notes that CSA 5.0.8[.]1 fixes this issue.

Other tracked vulnerabilities include CVE-2026-105425 (CVSS 7.2), described as an OS command injection shared by EPMM and Sentry, which requires admin privileges; CVE-2026-18128 (CVSS 6.8) in EPM that could enable an attacker in a Man-in-the-Middle position to read and modify agent HTTP traffic; and CVE-2026-105813 (CVSS 6.3) in UWM that stores data in cleartext, enabling a local user to steal another user’s session token.

Affected versions are EPM 2024 SU7 and earlier; CSA 5.0.8 only (5.0.7 and earlier are not affected); EPMM 12.10.0.0 and earlier, and 12.9.0.2 and earlier; Sentry 10.8.2 and earlier, and 10.7.3 and earlier; UWM 2026.2 and earlier. Patches accordingly: EPM to 2024 SU8; CSA to 5.0.8.1; EPMM to 12.11.0[.]0, 12.10.0[.]1 or 12.9.0[.]3; Sentry to 11.0.0, 10.8.3 or 10.7.4; and UWM to 2026.4.