Ivanti Endpoint Manager e Cloud Services… · Disclosed

Ivanti patches unauthenticated code execution in Endpoint Manager

Nov 11, 2026 · 1 min read

A SQL injection flaw in Ivanti Endpoint Manager allows unauthenticated code execution in versions before 2024 SU8. Another flaw lets attackers add or delete trusted certificates without authentication in Cloud Services Application 5.0.8. Ivanti recommends prioritizing updates for both products; no exploitation is known.

By HIFY Radar newsroom Updated 11/11/2026 02:09 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In 30 seconds

Alleged

Ivanti has reportedly released fixes for two critical vulnerabilities: CVE-2026-121653 in Endpoint Manager, which could allow unauthenticated code execution, and CVE-2026-121683 in Cloud Services Application, which could permit unauthenticated changes to trusted certificates. Administrators are being urged to update both products promptly.

What happened

Alleged

The Endpoint Manager flaw is described as a SQL injection affecting EPM Core releases before 2024 SU8. The certificate-management flaw reportedly affects Cloud Services Application 5.0.8 and can let an attacker add or delete trusted certificate entries without logging in.

Why it matters

Inferred

Endpoint Manager is used to administer company computers, so code execution on its central server could give an attacker a powerful position inside an organization. Separately, unauthorized changes to trusted certificates could undermine systems that rely on those certificates to establish trust.

What to do

Alleged

Organizations running Ivanti products should identify their EPM Core and Cloud Services Application versions, then prioritize the updates for EPM and the affected application. The supplied reports specifically say Ivanti recommends patching these two products first.

Confirmed and still uncertain

Alleged

The reports say Ivanti has seen no evidence that these vulnerabilities are being exploited in the wild. That is not proof that exploitation has never occurred, and the supplied evidence provides no details about attack indicators, proof-of-concept code or how broadly vulnerable versions remain deployed.

What people are saying

Alleged

DarkWebInformer characterizes CVE-2026-121653 as a critical, remotely exploitable SQL injection with a CVSS score of 9.8. IntCyberDigest similarly reports that it can let someone run code without authentication and says the certificate flaw carries a 9.4 score.

Evolution

Alleged

The two critical issues are reportedly part of a November 2026 release addressing 13 vulnerabilities across five Ivanti products. IntCyberDigest also says Ivanti used AI to help identify some of the flaws and expects further disclosures, although the supplied evidence does not specify which findings involved AI.

Reach

Observed

5 independent groups, 2 updates, and 5 engagements.

Technical detail

Alleged

CVE-2026-121653 is described as SQL injection, meaning crafted input can interfere with a database query. In this case, the reported consequence is execution of malicious code on an EPM Core server without prior authentication. CVE-2026-121683 instead concerns unauthenticated manipulation of trusted certificate entries.

Sources and evidence

Observed

The supplied batch contains a record for Ivanti's November 2026 security-update page, but no captured article body. The detailed vulnerability claims come from two social-media accounts that point toward Ivanti material and broadly agree with each other, so they should be treated as attributed reporting rather than independent technical confirmation.