Ivanti published its November 2026 security update on 10 November, covering Endpoint Manager (EPM), Cloud Services Application (CSA), Sentry, Endpoint Manager Mobile (EPMM) and User Workspace Manager (UWM). This post leads with the two issues Ivanti rates Critical: an unauthenticated SQL injection in the EPM Core that Ivanti says can allow remote code execution, and a missing-authentication flaw in CSA 5.0.8 that Ivanti says can let an unauthenticated remote attacker add and delete trusted EPM Core certificate entries.
Ivanti's fixes are EPM 2024 SU8, which also addresses an EPM Agent issue Ivanti rates Medium, and CSA 5.0.8.1. Ivanti's CSA advisory says only version 5.0.8 is affected and that "Version 5.0.7 and prior is not impacted."
On its security-update blog, Ivanti wrote: "We have no evidence of these vulnerabilities being exploited in the wild." Its product advisories say Ivanti is "not aware of any customers being exploited" at the time of disclosure. CVE-2026-121653 and CVE-2026-121683 were not in CISA's Known Exploited Vulnerabilities catalog as of catalogVersion 2026.11.10, checked 11 November 2026 at 16:28 Asia/Jerusalem UTC+2. This post makes no exploitation claim.
Technical Information
CVE-2026-121653 (EPM Core). Ivanti's EPM advisory and its CVE record describe "SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8" that "allows a remote unauthenticated attacker to achieve remote code execution." Ivanti rates it Critical, 9.8, CWE-89, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-18128 (EPM Agent). The same 2024 SU8 release fixes "Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8," which Ivanti says allows a remote unauthenticated attacker in a MITM position "to read and modify HTTP traffic." Ivanti rates it Medium, 6.8, CWE-319, vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
CVE-2026-121683 (CSA). Ivanti's CSA advisory and CVE record describe "Missing authentication in Ivanti Cloud Services Application version 5.0.8" that "allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries." Ivanti rates it Critical, 9.4, CWE-306, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.
CVSS version labels. Ivanti's EPM and CSA advisory tables label these vectors CVSS 3.0. Ivanti's CVE records, and NVD's copies of them (status Received, metric type Secondary), give the same scores and vectors as CVSS 3.1. These are the same Ivanti scores, not separate assessments.
CSA affected version. The CSA advisory lists "5.0.8 only," resolved in 5.0.8.1, and states that 5.0.7 and prior are not impacted. Ivanti's CVE record encodes 5.0.8 as "unaffected" with a default status of "affected," which does not match the advisory or the record's own description. This post follows the advisory.
The CSA advisory's mitigation section says: "If Ivanti CSA is running with a Dual NIC configuration per Ivanti's documented best practices, the exposure is limited to the internal interface and cannot be exploited externally." That limit applies only under that condition, and it is not a substitute for upgrading 5.0.8 to 5.0.8.1.
Sentry, EPMM and UWM. None of these advisories lists an issue Ivanti rates Critical. The highest is CVE-2026-105425, an OS command injection in Sentry and EPMM that Ivanti says "allows a remote authenticated attacker with admin privileges to achieve remote code execution"; Ivanti rates it High, CVSS 3.1 7.2 (PR:H). The remaining Sentry and EPMM issues are ones Ivanti rates Medium, and all require an authenticated or local attacker. The UWM issue, CVE-2026-105813, is one Ivanti rates Medium (6.3); Ivanti says it "only affects UWM Neurons Hybrid environments and does not affect UWM on-premise or Ivanti Neurons for App Control."
Affected Product Versions
From Ivanti's advisory tables.
| Product | Affected | Fixed |
|---|---|---|
| Endpoint Manager (EPM) | 2024 SU7 and prior | 2024 SU8 (CVE-2026-121653, CVE-2026-18128) |
| Cloud Services Application (CSA) | 5.0.8 only (5.0.7 and prior not impacted) | 5.0.8.1 |
| Sentry | 10.8.2 and prior; 10.7.3 and prior | 11.0.0; 10.8.3; 10.7.4 |
| Endpoint Manager Mobile (EPMM) | 12.10.0.0 and prior; 12.9.0.2 and prior | 12.11.0.0; 12.10.0.1; 12.9.0.3 |
| User Workspace Manager (UWM), Neurons Hybrid only | 2026.2 and prior | 2026.4 |
Ivanti's security-update blog also states: "These vulnerabilities do not impact any other Ivanti solutions."
Exploitation Status
Ivanti's 10 November security-update blog says: "We have no evidence of these vulnerabilities being exploited in the wild." Each product advisory says Ivanti is "not aware of any customers being exploited" at the time of disclosure and that the issues came through its responsible disclosure program. Ivanti's separate Patch Tuesday blog repeats that wording for the EPMM and EPM issues only.
CISA-ADP's SSVC entry on the CVE-2026-121653 record, added 11 November 2026, sets Exploitation to "none." Neither lead CVE was in the CISA catalog at the 16:28 check. This post makes no exploitation claim.
Workaround and Mitigation
Ivanti's remediation is to install the fixed releases above. The EPM, Sentry, EPMM and UWM advisories list no workaround. For CSA, the conditional Dual NIC statement quoted above is Ivanti's only stated exposure limit, and it does not replace 5.0.8.1 for 5.0.8 deployments.
Indicators of Compromise
Ivanti's advisories say: "Currently, there is no known public exploitation of this vulnerability that could be used to provide a list of indicators of compromise" (the EPM advisory says "these vulnerabilities"). No indicators have been published, and this post does not supply any.
What to Ask Your MSPs and IT Outsourcers Today
EPM is often run by managed service providers and IT outsourcers on behalf of their customers, and its Core server manages agents across those customers' endpoints. CSA is the gateway that lets those agents reach the Core from outside the corporate network, so it typically sits at the perimeter. Ask suppliers that manage endpoints for you, in writing:
- Whether they run Ivanti EPM or CSA for your environment, and which versions.
- Whether EPM 2024 SU8 and CSA 5.0.8.1 are installed, and when.
- Whether any CSA instance is on 5.0.8, how it is exposed to the internet, and whether it uses a Dual NIC configuration per Ivanti's documented best practices.
- Whether Sentry, EPMM or UWM Neurons Hybrid, if used, are on the fixed releases above.
If you operate these products yourself, apply Ivanti's fixed releases first, then confirm the same points against your inventory.
If your team needs help reviewing which suppliers run Ivanti EPM or CSA and whether they have applied these updates, Talk to an expert.
Sources
- November 2026 Security Update, Ivanti, 10 November 2026; exploitation statement and product scope.
- Security Advisory Ivanti Endpoint Manager (EPM) November 2026, Ivanti (article 000110070); CVE-2026-121653 and CVE-2026-18128; fixed in 2024 SU8.
- Security Advisory Ivanti CSA (CVE-2026-121683), Ivanti (article 000110079); 5.0.8 only, fixed in 5.0.8.1; Dual NIC statement.
- Security Advisory Ivanti Sentry, EPMM and UWM advisories, Ivanti. All advisories rechecked 11 November 2026 at 16:28 Asia/Jerusalem UTC+2.
- November 2026 Patch Tuesday, Ivanti, 10 November 2026.
- CVE-2026-121653 and NVD — Ivanti CNA, CVSS 3.1 9.8; NVD status Received, metric Secondary; CISA-ADP SSVC Exploitation none.
- CVE-2026-121683 and NVD — Ivanti CNA, CVSS 3.1 9.4; NVD status Received, metric Secondary.
- CVE-2026-18128 — Ivanti CNA, CVSS 3.1 6.8.
- CISA catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; CVE-2026-121653 and CVE-2026-121683 are not in CISA KEV as of 11 November 2026 at 16:28 Asia/Jerusalem UTC+2.
- Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities, SecurityWeek, 11 November 2026; secondary coverage, checked against Ivanti's advisories.
