Ivanti patches multiple vulnerabilities across products
CERT-FR advisory details multiple vulnerabilities in Ivanti CSA, EPM, EPMM, Sentry, and UWM enabling RCE, DoS, and data exposure; patches available.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory covering multiple vulnerabilities across several Ivanti product lines: Cloud Services Application (CSA), Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, and User Workspace Manager (UWM). The vulnerabilities, disclosed by Ivanti on 10 November 2026 across several separate security bulletins, allow attackers to achieve remote code execution, remote denial of service, SQL injection, security policy bypass, and compromise of data confidentiality and integrity depending on the specific product and flaw.
Affected versions include Ivanti CSA 5.0.8 (prior to 5.0.8.1), Ivanti EPM (prior to 2024 SU8), Ivanti EPMM 12.9.0.x (prior to 12.9.0.3) and versions prior to 12.10.0.1, Ivanti Sentry 10.7.x (prior to 10.7.4) and 10.8.x (prior to 10.8.3), and Ivanti UWM (prior to 2026.4). Fourteen CVEs are referenced across the bulletins (CVE-2026-105425, -105426, -105427, -105669, -105813, -107404, -107405, -121653, -121683, -123179, -123181, -18128, -83528, among others), spanning the various products. The advisory does not indicate active exploitation in the wild at time of publication.
Defenders running any of these Ivanti products should prioritize patching to the fixed versions referenced in the vendor bulletins, particularly given the mix of RCE and SQL injection vulnerabilities that could allow significant compromise of exposed management infrastructure. Ivanti products, especially EPMM and CSA, have historically been high-value targets for exploitation, so timely patching and monitoring for anomalous access to these management platforms is recommended.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1506
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs