Ivanti has rolled out updates to patch a range of serious vulnerabilities across its Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Application (CSA), and User Workspace Manager (UWM). The flaws span risks like remote code execution (RCE), trusted certificate tampering, data exposure, and service disruption, with two vulnerabilities ranking as critical. All of this is part of Ivanti’s November 2026 security disclosures.
Top-Risk Threats Demanding Urgent Action
The most dangerous flaw identified is CVE-2026-121653, an SQL injection bug in EPM Core versions before 2024 Service Update 8. It carries a CVSS score of 9.8, representing unauthenticated attackers’ ability to execute arbitrary code remotely. Similarly serious is CSA’s CVE-2026-121683 (CVSS 9.4), in version 5.0.8, which lets attackers without credentials add or remove trusted EPM Core certificate entries. Ivanti has patched this with version 5.0.8.1.
Other Notable Flaws and Affected Products
EPMM and Sentry share several vulnerabilities. CVE-2026-105425 (CVSS 7.2) allows administrators with existing privileges to execute commands at the OS level via command injection. Other significant issues in EPMM (CVE-2026-105426, -105427, -107404, -83528) include root-level changes to Linux kernel settings, disabling HTTPS services, arbitrary file deletion, and exposure of personal information. Another vulnerability, CVE-2026-107405, enables local exploitation to disrupt services (DoS).
Sentry has its own critical problems: CVE-2026-105669 is an argument injection flaw for remote admin access; CVE-2026-123179 allows local authenticated users to stop services via Tomcat shutdown; CVE-2026-123181 grants remote admins permission to create files and directories as root. Fixed versions for Sentry include 11.0.0, 10.8.3, and 10.7.4.
User Workspace Manager addresses one medium-severity issue: CVE-2026-105813 describes a flaw where local authenticated users could access another user’s session data, due to cleartext storage. This is resolved in UWM 2026.4.
Recommended Actions & Context
Ivanti stresses that while there’s no evidence these flaws have been exploited in the wild, the unauthenticated EPM and CSA issues pose extreme risk. Administrators are urged to upgrade ASAP: EPM to 2024 SU8, CSA to version 5.0.8.1, EPMM and Sentry to the versions listed, and UWM to 2026.4. The fixes are distributed via Ivanti’s licensing mechanism.
Limiting exposure through network configuration—such as isolating internal interfaces—can reduce risk temporarily but doesn’t replace installing the updates. After patching, verifying installed versions and keeping SOC teams informed with vulnerability context are key defensive measures. No official indicators of compromise are available yet.
These patches arrive amidst growing attention to software supply chain security and the dangers of remote code execution bugs. The chips away at defenses are becoming sharper—this set of Ivanti flaws makes clear that any product with remote-access functionality needs continuous scrutiny.
What this means: These vulnerabilities are high-severity, especially the unauthenticated ones. They offer attackers a direct route into enterprise systems. If your organization uses Ivanti products, prioritizing the critical patches is essential. Watch for signs of misuse—unexpected changes to certificates, unusual admin activity—and ensure your defenses aren’t relying solely on access controls. The next few days could be critical.
