If you manage Ivanti Endpoint Manager, check both the Core server and any Cloud Services Application (CSA) that connects remote agents. Ivanti disclosed two critical vulnerabilities on November 10, 2026, with a separate fix for each component.
Affected systems and fixes
- EPM Core · CVE-2026-121653. A remote attacker who can reach the vulnerable Core can execute code through SQL injection without authenticating. Ivanti rates it Critical, CVSS 3.0 9.8. EPM 2024 SU7 and prior are affected. Upgrade to 2024 SU8 through the Ivanti Licensing System. The same release fixes CVE-2026-18128, a Medium CVSS 3.0 6.8 Agent issue that lets an unauthenticated attacker in a man-in-the-middle position read or modify HTTP traffic.
- CSA · CVE-2026-121683. A remote unauthenticated attacker with access to the exposed interface can add or delete trusted EPM Core certificate entries. Ivanti’s advisory lists CVSS 3.0 9.4 Critical. The advisory identifies 5.0.8 as the only affected version, explicitly excludes 5.0.7 and earlier, and identifies 5.0.8.1 as the fix. The CNA record’s structured data incorrectly labels 5.0.8 unaffected while its description calls it affected. Use the product advisory’s explicit version matrix. The CNA lists CVSS 3.1 9.4.
Ivanti reported no evidence of exploitation at disclosure. These CVEs were absent from the CISA KEV catalog checked November 10. Ivanti published no indicators of compromise for these issues. Ivanti says its documented dual-NIC configuration limits CSA exposure to the internal interface and prevents external exploitation. Internal reachability remains relevant.
Suggested MSP response
- Inventory. Record each customer’s Core and CSA build. Check which networks can reach each interface and whether CSA follows Ivanti’s dual-NIC design.
- Contain. Prioritize reachable Cores and CSA interfaces. Restrict unnecessary access where operationally safe. If you find unexpected certificate changes or signs of compromise, isolate the affected component, preserve logs and certificate records, and follow your incident-response process.
- Patch and verify. Use the supported upgrade path to EPM 2024 SU8 and CSA 5.0.8.1 where applicable. Verify the installed builds, compare trusted Core certificates to the approved inventory, and confirm Core connectivity and remote agent check-ins.
Published by Ivanti November 10, 2026. Last verified November 10, 2026.