Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager

Ivanti has released security updates for Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Application, and User Workspace Manager.

The November 2026 disclosures cover flaws that could allow remote code execution, changes to trusted certificates, data exposure, and service disruption. Two critical vulnerabilities in Endpoint Manager and CSA present the highest risks.

Ivanti said it was not aware of customers being exploited through these vulnerabilities before public disclosure. The issues were reported through its responsible disclosure program.

However, the lack of reported attacks does not remove the need to patch, particularly where attackers can reach affected services without logging in.

Multiple Ivanti Security Flaws

The most severe issue, CVE-2026-121653, carries a CVSS score of 9.8. This SQL injection vulnerability affects the Endpoint Manager Core before version 2024 SU8 and allows remote attackers to execute code without authentication. Earlier Endpoint Manager SQL injection flaws also exposed management servers to code execution flaws.

Endpoint Manager also fixes CVE-2026-18128, rated 6.8. Sensitive information travels in cleartext through the agent, allowing an attacker positioned between communicating systems to read and change HTTP traffic.

Both vulnerabilities affect EPM 2024 SU7 and earlier, with fixes available in 2024 SU8 through the Ivanti License System.

CSA’s critical flaw, CVE-2026-121683, scores 9.4 and affects version 5.0.8 only. Missing authentication lets remote attackers add or delete arbitrary trusted EPM Core certificate entries. This is separate from previously reported Ivanti CSA authentication and code execution vulnerabilities, which required different updates.

According to the supplied CSA advisory, version 5.0.8.1 fixes the issue. Versions 5.0.7 and earlier are not affected by this specific flaw.

A dual network interface configuration following Ivanti’s guidance limits exposure to the internal interface and prevents external exploitation, but administrators should still install the update.

The EPMM advisory lists six vulnerabilities. CVE-2026-105425, rated 7.2, allows remote attackers with administrator privileges to execute code through operating system command injection.

The same vulnerability also affects Sentry, making it important for organizations running both products to update each deployment.

Other EPMM issues allow administrators to change Linux kernel settings as root, disable Apache HTTPS services, delete arbitrary files, or expose protected personal information.

These are CVE-2026-105426, CVE-2026-105427, CVE-2026-107404, and CVE-2026-83528. A separate local flaw, CVE-2026-107405, can cause denial of service. Listed fixed releases include 12.11.0.0, 12.10.0.1, and 12.9.0.3.

The Sentry advisory also describes CVE-2026-105669, an argument injection flaw that lets remote administrators execute existing disk binaries. CVE-2026-123179 allows a local authenticated attacker to disrupt service through the Tomcat shutdown listener.

CVE-2026-123181 lets remote administrators create arbitrary files and directories with root privileges. Fixed versions include 11.0.0, 10.8.3, and 10.7.4.

User Workspace Manager addresses CVE-2026-105813, a medium-severity cleartext storage flaw. A local authenticated attacker could retrieve another local user’s session.

Ivanti directs customers to install UWM 2026.4, available through its licensing system, according to the supplied Workspace Manager advisory.

Security teams should prioritize the unauthenticated EPM and CSA vulnerabilities, then schedule the remaining updates based on exposure and access controls.

Ivanti has not supplied vulnerability-specific indicators of compromise because no public exploitation is known. Administrators should confirm installed versions after patching and avoid treating restricted administrative access as a replacement for updates.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager appeared first on Cyber Security News.