Ivanti Patches Critical EPM SQL Injection and CSA Flaws in November 2026 Security Advisories
Do Son 
TL;DR
Ivanti released five security advisories on November 10, 2026, fixing 13 vulnerabilities across five products. The worst flaw, CVE-2026-121653, is a CVSS 9.8 SQL injection in Ivanti Endpoint Manager that allows unauthenticated remote code execution. A second critical bug, CVE-2026-121683 (CVSS 9.4), hits Ivanti Cloud Services Application. These Ivanti security advisories also cover EPMM, Sentry and User Workspace Manager.
Ivanti fixed two critical flaws, one high and ten medium across EPM, CSA, EPMM, Sentry and UWM. Ivanti says it is not aware of any exploitation. Update EPM to 2024 SU8 and CSA to 5.0.8.1 first.
- Total: 7 CVEs
- Severity: 2 Critical · 1 High · 4 Medium
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-121653
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-105813 | 6.3 | 2026.4 | Not exploited |
Why It Matters
Ivanti products manage endpoints and mobile devices, which makes them prized targets. In fact, CISA’s catalog lists 38 exploited Ivanti flaws. Eight were added in 2026 alone, covering EPM, EPMM, Sentry and Connect Secure. As a result, a pre-auth RCE in the Ivanti Endpoint Manager Core deserves fast action.
For now, the risk appears contained. Each advisory states: “We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure.” In addition, none of the 13 CVEs is in CISA’s Known Exploited Vulnerabilities catalog.
How the Attack Works
Endpoint Manager (EPM)
CVE-2026-121653 is a SQL injection in the EPM Core that “allows a remote unauthenticated attacker to achieve remote code execution.” Meanwhile, CVE-2026-18128 (CVSS 6.8) lets an attacker in a man-in-the-middle position read and modify agent HTTP traffic. Details are in the Ivanti EPM November 2026 advisory.
Cloud Services Application (CSA)
CVE-2026-121683 stems from missing authentication in CSA 5.0.8. An unauthenticated attacker can “add and delete arbitrary trusted EPM Core certificate entries.” See the Ivanti CSA CVE-2026-121683 advisory.
EPMM and Sentry
CVE-2026-105425 (CVSS 7.2) is an OS command injection shared by both products. However, it requires admin privileges. Ivanti credits btaol of Aquila Sec Lab with the report. The Ivanti EPMM advisory lists five more medium bugs, including kernel parameter changes and file deletion. Likewise, the Ivanti Sentry advisory adds argument injection, path traversal and a Tomcat denial of service.
User Workspace Manager (UWM)
Finally, CVE-2026-105813 stores data in cleartext, letting a local user steal another user’s session token. The Ivanti UWM advisory has the details.
Affected Versions
- EPM 2024 SU7 and earlier
- CSA 5.0.8 only (5.0.7 and earlier are not affected)
- EPMM 12.10.0.0 and earlier, and 12.9.0.2 and earlier
- Sentry 10.8.2 and earlier, and 10.7.3 and earlier
- UWM 2026.2 and earlier
Patch and Mitigation
- EPM: update to 2024 SU8.
- CSA: update to 5.0.8.1. Ivanti notes a Dual NIC setup limits exposure “to the internal interface.”
- EPMM: update to 12.11.0.0, 12.10.0.1 or 12.9.0.3.
- Sentry: update to 11.0.0, 10.8.3 or 10.7.4.
- UWM: update to 2026.4.
Overall, these Ivanti security advisories call for patching EPM and CSA first, then the rest.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
