Ivanti published five security advisories fixing 13 vulnerabilities, led by CVE-2026-121653, a CVSS 9.8 SQL injection in Endpoint Manager that can lead to unauthenticated remote code execution, and CVE-2026-121683, a CVSS 9.4 missing-authentication flaw in Cloud Services Application.
Ivanti reported no exploitation at the time of disclosure. The 13 flaws comprise two critical, one high and ten medium-severity issues.
CVE-2026-121653 Lets SQL Injection Escalate to Unauthenticated RCE
The Endpoint Manager flaw is a SQL injection in EPM Core. According to the advisory, it can lead to unauthenticated remote code execution, which means an attacker does not need credentials to run code on the affected server. The flaw affects EPM 2024 SU7 and earlier, and Ivanti fixed it in EPM 2024 SU8.
Endpoint management servers hold broad authority over the devices they administer, so a remote code execution flaw on the server carries consequences for every managed endpoint.
Cloud Services Application Missing Authentication
CVE-2026-121683 is a missing authentication flaw in Cloud Services Application version 5.0.8. Ivanti addressed it in version 5.0.8.1. The 9.4 score reflects the ability to reach protected functionality without logging in.
Lower-Severity Ivanti Fixes Across EPMM, Sentry and UWM
Beyond the two critical issues, the advisories include CVE-2026-105425, a command injection rated 7.2 that affects Endpoint Manager Mobile (EPMM) and Sentry. CVE-2026-105813, rated 6.3, is a cleartext storage issue in Workspace Control, known as UWM.
Fixed Versions for Each Ivanti Product
Ivanti fixed EPMM in versions 12.11.0.0, 12.10.0.1 and 12.9.0.3. Sentry fixes arrive in 11.0.0, 10.8.3 and 10.7.4, and the UWM fix is in version 2026.4. Together with the EPM and CSA updates, those builds cover all five advisories.
The lists of fixed versions across several branches means that EPMM and Sentry customers can remain on their current release line while picking up the correction.
Why Ivanti Flaws Draw Fast Attacker Attention
Ivanti products have a record of rapid exploitation after vulnerabilities become public. That history shapes how defenders read this release: although no attack is known, the combination of an unauthenticated remote code execution path and a vendor whose products attackers have previously targeted places the EPM and CSA updates at the front of the queue.
Ivanti’s advisory set also spans several product families, so organizations may be running more than one affected product. Endpoint Manager and Cloud Services Application are the two with critical ratings, and the guidance accompanying the release is to prioritize them.
The distinction between critical and medium flaws matters operationally. The 10 medium-severity issues are unlikely to require an emergency change window, but the two critical fixes can justify one, especially for EPM servers reachable from outside the corporate network. Administrators who cannot patch immediately can at least identify which Ivanti products they run and which versions fall within the affected ranges, so that upgrades can be sequenced by exposure.
Reading the Five Ivanti Advisories Together
The five advisories cover Endpoint Manager (EPM), Cloud Services Application (CSA), Endpoint Manager Mobile (EPMM), Sentry and Workspace Control (UWM). Only EPM and CSA carry critical ratings, but the command injection flaw CVE-2026-105425 spans both EPMM and Sentry, so customers running either need to check their versions. The cleartext storage issue in UWM, CVE-2026-105813, is the lowest-rated of the named bugs at 6.3.
Ivanti reported no exploitation when it published the advisories. For EPM, the fix is the 2024 SU8 release, and any installation on 2024 SU7 or earlier remains within the affected range.
Ivanti’s patch table also shows how the fixes are spread across release trains. EPMM has three corrected builds, Sentry has three, and Workspace Control moves to a single 2026.4 release, so customers on older supported lines can pick up the correction without a major version change. Organizations that run several of these products should treat the five advisories as one change-management effort, not five separate ones, since the critical EPM and CSA fixes and the lower-rated fixes can often be scheduled together.
