Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA auth bypass (CVE-2026-121683) in a 19-flaw Patch Tuesday
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2026-102705, CVE-2026-105425, CVE-2026-121653, CVE-2026-121683
On Tuesday 2026-11-10 Ivanti and Citrix published patches for 19 vulnerabilities. Ivanti fixed 13 flaws across five products. The two criticals are CVE-2026-121653 (CVSS 9.8 per NVD), an unauthenticated SQL injection in the Endpoint Manager Core that leads to remote code execution, fixed in EPM 2024 SU8; and CVE-2026-121683 (CVSS 9.4 per NVD), a missing-authentication flaw in Cloud Services Application 5.0.8 that lets an unauthenticated remote attacker add and delete trusted EPM Core certificate entries, fixed in CSA 5.0.8.1. SecurityWeek reports that Dual NIC deployments cannot be exploited externally. Ivanti also fixed CVE-2026-105425 in Sentry (high, CVSS 7.2 per NVD), an OS command injection that NVD says needs administrator privileges; the same CVE is fixed in EPMM, which also received five medium issues. Citrix fixed six XenServer flaws, including a high-severity CVE-2026-102705 that SecurityWeek says allows Pool Secret inference and host compromise; that CVE does not appear in NVD or in Citrix's bulletin CTX697170, so it is unverified. XenServer also received updates for AMD CPU issues. Neither vendor reports exploitation. None of these CVE IDs is in CISA KEV at catalog 2026.11.10. Patch CSA to 5.0.8.1 and EPM to 2024 SU8 first, then Sentry and EPMM to the versions listed below.
What to do
- Patch Ivanti CSA to 5.0.8.1 immediately; verify Dual NIC exposure as a temporary mitigation
- Update Ivanti EPM to 2024 SU8 and restrict database access pending patch
- Update Sentry to 11.0.0, 10.8.3 or 10.7.4, and EPMM to 12.11.0.0, 12.10.0.1 or 12.9.0.3 (CVE-2026-105425; NVD says admin privileges are needed)
- Apply Citrix XenServer security updates, including AMD CPU mitigations
- Review certificate trust entries in EPM Core for tampering and audit for signs of exploitation
Fixed versions
- CSA 5.0.8.1
- EPM 2024 SU8
- Sentry 11.0.0, 10.8.3 and 10.7.4 (CVE-2026-105425)
- EPMM 12.11.0.0, 12.10.0.1 and 12.9.0.3 (CVE-2026-105425)
Sources
All live incidents on Threat Watch
