Skip to content
Hacker Posts

Ivanti patches critical EPM SQLi-to-RCE and CSA auth flaw

Ivanti's November 2026 update fixes 13 flaws, led by CVE-2026-121653 (CVSS 9.8), unauthenticated SQLi-to-RCE in Endpoint Manager, and CVE-2026-121683 (9.4) in Cloud Services Application.

Published 3 min read
cveivantiadvisoryendpoint-manager

Ivanti shipped its November 2026 security update, fixing 13 vulnerabilities across five products. Two are critical: CVE-2026-121653 (CVSS 9.8), an unauthenticated SQL-injection-to-RCE in Endpoint Manager (EPM), and CVE-2026-121683 (CVSS 9.4), a missing-authentication flaw in the Cloud Services Application (CSA). Ivanti says it has no evidence of exploitation.

The primary reference is Ivanti's November 2026 security update post, which links the per-product advisories; the CVSS scores were reported by SecurityWeek.

What's affected

  • CVE-2026-121653 (CVSS 9.8) — SQL injection in Endpoint Manager that leads to unauthenticated remote code execution. Fixed in EPM 2024 SU8.
  • CVE-2026-121683 (CVSS 9.4) — missing authentication in CSA. A remote, unauthenticated attacker can add and delete arbitrary trusted EPM Core certificate entries. Fixed in CSA 5.0.8.1. Per Ivanti, this is not externally exploitable in Dual-NIC deployments.
  • CVE-2026-105425 (high) — remote code execution in Sentry, also addressed in Endpoint Manager Mobile (EPMM).

The update also covers a cleartext-transmission issue in EPM 2024 SU8, additional Sentry and EPMM flaws, and a User Workspace Manager defect. See Ivanti's post for the full list and per-product advisories.

Exploitation status

Ivanti states: "We have no evidence of these vulnerabilities being exploited in the wild." No proof-of-concept was public at release and the vendor shipped no IOCs, so there is nothing to detect yet. That caveat has a short half-life with Ivanti gear — patch on the assumption that the window closes fast.

Action checklist

  1. Patch EPM to 2024 SU8 first. CVE-2026-121653 is unauthenticated RCE on a management server that touches every managed endpoint — treat it as the top priority.
  2. Update CSA to 5.0.8.1. If you run a single-NIC CSA deployment, CVE-2026-121683 is internet-reachable; move it to the front of the queue.
  3. Patch Sentry and EPMM for CVE-2026-105425.
  4. Restrict management-plane exposure. EPM, CSA, and Sentry should not be broadly internet-facing; put them behind VPN or allow-listing where your architecture permits.
  5. Hunt retroactively on internet-exposed CSA and EPM for anomalous certificate-trust changes and unexpected database or process activity, in case exposure predated the patch.

Context

Ivanti's management and edge products have been among the most-targeted enterprise software of the past two years — its Connect Secure line drew an unauthenticated zero-day exploit chain earlier this cycle, and multiple Ivanti CVEs have landed on CISA's KEV catalog within days of disclosure. Nothing here is flagged exploited, but the base rate for this vendor argues for fast patching rather than waiting for a KEV add to force the schedule.

Related stories