Citrix and Ivanti patch 19 flaws, including critical bugs

SecurityWeek reports that Citrix and Ivanti issued patches for a combined 19 vulnerabilities across their products, including multiple critical- and high-severity flaws. Ivanti’s fixes cover 13 defects across five products, highlighting two critical issues in Cloud Services Application (CSA) and Endpoint Manager (EPM).

The CSA flaw is CVE-2026-121683 (CVSS 9.4), described as a missing authentication bug that could let remote, unauthenticated attackers add and delete arbitrary trusted EPM Core certificate entries; Ivanti notes that CSA version 5.0.8.1 contains the fix and that deployments with Dual NIC configuration cannot be exploited externally.

The critical EPM flaw, CVE-2026-121653 (CVSS 9.8), is an SQL injection vulnerability that could enable remote code execution without authentication and was addressed in EPM version 2024 SU8, which also patches a medium-severity issue involving cleartext transmission of sensitive information exploitable via MitM.

SecurityWeek adds that Ivanti also released patches for four vulnerabilities in Sentry, including a high-severity remote code execution flaw tracked as CVE-2026-105425, which has also been fixed in Endpoint Manager Mobile (EPMM) along with five medium-severity issues. Ivanti says there is no evidence of exploitation in the wild for these issues.

Separately, Citrix rolled out XenServer fixes for six defects, including CVE-2026-102705, a high-severity bug that could allow attackers to infer the Pool Secret and compromise the host; the remaining issues could enable privilege escalation or allow administrators to terminate tasks by other roles. Citrix also released XenServer updates to mitigate several AMD CPU vulnerabilities affecting guest VMs.