Ivanti has launched November 2026 safety updates for Endpoint Supervisor (EPM), Endpoint Supervisor Cell (EPMM), Sentry, Cloud Companies Software (CSA), and Person Workspace Supervisor (UWM). The issues expose methods to distant code execution, certificates modifications, knowledge theft, and repair disruption. Essential EPM and CSA vulnerabilities require quick consideration.
Ivanti mentioned the problems got here by way of accountable disclosure, with no identified buyer exploitation earlier than publication. Nonetheless, companies reachable with out authentication stay pressing patching targets. Earlier Endpoint Supervisor SQL injection vulnerabilities reveal the dangers dealing with administration infrastructure.
Ivanti SQL Injection Flaw
Essentially the most extreme flaw, CVE-2026-121653, scores 9.8 and permits distant, unauthenticated attackers to execute code by way of SQL injection in EPM Core earlier than 2024 SU8. CVE-2026-18128, rated 6.8, exposes delicate agent data in cleartext, permitting attackers between speaking methods to learn or modify HTTP visitors. Each have an effect on EPM 2024 SU7 and earlier; SU8 is on the market by way of the Ivanti License System.
CSA’s CVE-2026-121683 scores 9.4. Lacking authentication permits distant attackers so as to add or delete arbitrary trusted EPM Core certificates entries. Solely model 5.0.8 is affected; 5.0.7 and earlier are unaffected. The equipped CSA advisory identifies 5.0.8.1 because the repair.
Following Ivanti’s twin community interface steering limits publicity to the interior interface, stopping exterior exploitation. Patching stays mandatory. These certificates modifications differ from earlier CSA authentication and injection flaws.
The EPMM advisory lists six vulnerabilities. CVE-2026-105425, rated 7.2, permits distant directors to execute code by way of working system command injection. It additionally impacts Sentry, requiring separate updates throughout each merchandise.
CVE-2026-105426 lets distant directors set Linux kernel parameters as root; CVE-2026-105427 completely disables Apache HTTPS companies. CVE-2026-107404 permits arbitrary file deletion, whereas CVE-2026-83528 exposes GDPR-protected private data.
These points require administrator entry. Authenticated native attackers can set off a denial of service by way of CVE-2026-107405. Mounted EPMM releases are 12.11.0.0, 12.10.0.1, and 12.9.0.3.
Sentry additionally fixes CVE-2026-105669, an argument injection flaw that lets distant directors execute current disk binaries. CVE-2026-123179 lets native authenticated attackers disrupt service by way of the Tomcat shutdown listener. CVE-2026-123181 permits distant directors to create arbitrary information and directories as root. Mounted releases embody 11.0.0, 10.8.3, and 10.7.4.
UWM fixes CVE-2026-105813, a medium-severity cleartext storage flaw permitting native authenticated attackers to retrieve one other native consumer’s session. Clients ought to set up UWM 2026.4 by way of Ivanti’s licensing system.
Safety groups ought to prioritize unauthenticated EPM and CSA publicity, then patch remaining deployments based on entry and threat. Earlier EPMM and Sentry updates addressed separate vulnerabilities. Ivanti equipped no vulnerability-specific compromise indicators as a result of public exploitation is unknown. Confirm put in variations after updating; restricted administrator entry doesn’t substitute patches.
Give your SOC the alert context to stops incidents shortly. Combine Menace Intel from 16K SOCs.
