Ivanti Endpoint Manager flaw lets attackers run code on the management server without a login (CVE-2026-121653)

12 November 2026Critical 9.8

Ivanti · Ivanti Endpoint Manager (EPM) and Cloud Services Application (CSA) · CVE-2026-121653

Ivanti Endpoint Manager flaw lets attackers run code on the management server without a login

An SQL injection flaw in the core server of Ivanti Endpoint Manager lets a remote attacker run code without logging in. EPM is the tool IT teams use to manage and push software to every PC, so a takeover of that server reaches the whole fleet. The same 10 November update fixes CVE-2026-121683 (CVSS 9.4) in Ivanti's Cloud Services Application, where a missing login check lets an outsider add or delete trusted EPM Core certificate entries. Ivanti says it has no evidence of either being exploited.

Affected: Ivanti Endpoint Manager before 2024 SU8 (CVE-2026-121653). Ivanti Cloud Services Application 5.0.8 (CVE-2026-121683); SecurityWeek reports that CSA set up with two network interfaces (Dual NIC) cannot be attacked from outside. Ivanti's update also covers Sentry, Endpoint Manager Mobile and User Workspace Manager.
What to do: Update Endpoint Manager to 2024 SU8. Update Cloud Services Application to the fixed release, which SecurityWeek reports as 5.0.8.1; confirm the version against Ivanti's CSA advisory. Until then, keep the EPM core server and CSA off the open internet where you can. If an IT provider manages your PCs with Ivanti EPM, ask them to confirm they have updated.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Critical (CVSS 9.8), no login needed, in an Ivanti management product; Ivanti flaws have been quick to attract attackers.

Ivanti Endpoint Manager flaw lets attackers run code on the management server without a login

Affected

Ivanti Endpoint Manager before 2024 SU8 (CVE-2026-121653). Ivanti Cloud Services Application 5.0.8 (CVE-2026-121683); SecurityWeek reports that CSA set up with two network interfaces (Dual NIC) cannot be attacked from outside. Ivanti's update also covers Sentry, Endpoint Manager Mobile and User Workspace Manager.

What to do

Update Endpoint Manager to 2024 SU8. Update Cloud Services Application to the fixed release, which SecurityWeek reports as 5.0.8.1; confirm the version against Ivanti's CSA advisory. Until then, keep the EPM core server and CSA off the open internet where you can. If an IT provider manages your PCs with Ivanti EPM, ask them to confirm they have updated.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Critical (CVSS 9.8), no login needed, in an Ivanti management product; Ivanti flaws have been quick to attract attackers.