# Ivanti patches multiple vulnerabilities across products

Published: 2026-11-12 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/6ab0de17-595b-50b0-97a3-6621e68541cb/ivanti-patches-multiple-vulnerabilities-across-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory details multiple vulnerabilities in Ivanti CSA, EPM, EPMM, Sentry, and UWM enabling RCE, DoS, and data exposure; patches available.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1506

## What to check

- Applies to: The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory covering multiple vulnerabilities across several Ivanti product lines: Cloud Services Application (CSA), Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, and User Workspace Manager (UWM). The vulnerabilities, disclosed by Ivanti on 10 November 2026 across several separate security bulletins, allow attackers to achieve remote code execution, remote denial of service, SQL injection, security policy bypass, and compromise of data confidentiality and integrity depending on the specific product and flaw.

Affected versions include Ivanti CSA 5.0.8 (prior to 5.0.8.1), Ivanti EPM (prior to 2024 SU8), Ivanti EPMM 12.9.0.x (prior to 12.9.0.3) and versions prior to 12.10.0.1, Ivanti Sentry 10.7.x (prior to 10.7.4) and 10.8.x (prior to 10.8.3), and Ivanti UWM (prior to 2026.4). Fourteen CVEs are referenced across the bulletins (CVE-2026-105425, -105426, -105427, -105669, -105813, -107404, -107405, -121653, -121683, -123179, -123181, -18128, -83528, among others), spanning the various products. The advisory does not indicate active exploitation in the wild at time of publication.

Defenders running any of these Ivanti products should prioritize patching to the fixed versions referenced in the vendor bulletins, particularly given the mix of RCE and SQL injection vulnerabilities that could allow significant compromise of exposed management infrastructure. Ivanti products, especially EPMM and CSA, have historically been high-value targets for exploitation, so timely patching and monitoring for anomalous access to these management platforms is recommended.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105425, CVE-2026-105426, CVE-2026-105427, CVE-2026-105669, CVE-2026-105813, CVE-2026-107404, CVE-2026-107405, CVE-2026-121653, CVE-2026-121683, CVE-2026-123179, CVE-2026-123181, CVE-2026-18128, CVE-2026-83528

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1506

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6ab0de17-595b-50b0-97a3-6621e68541cb/ivanti-patches-multiple-vulnerabilities-across-products.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup