Ivanti has released security updates to address critical vulnerabilities in its Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Cloud Services Application (CSA), and other products. These updates aim to mitigate risks associated with unauthenticated access vulnerabilities.
The most severe vulnerability, CVE-2026-121653, is a SQL injection flaw with a CVSS score of 9.8. This vulnerability allows for unauthenticated remote code execution. Ivanti resolved this issue in EPM version 2024 SU8.
Another critical vulnerability, CVE-2026-121683, affects the CSA and allows remote attackers to manipulate trusted certificate entries. This flaw is described as a missing authentication issue and has been fixed in CSA version 5.0.8.1.
In total, the updates address 13 vulnerabilities across multiple products, including high and medium severity issues. The EPMM advisory lists six vulnerabilities, including CVE-2026-105425, which enables remote administrators to execute code through operating system command injection.
Ivanti has stated that there is no evidence of exploitation prior to the release of these patches. Organizations are urged to update to the latest versions to mitigate potential risks.