EN PT-BR
← Voltar ao feed
high

Ivanti fixes unauthenticated SQL injection RCE in EPM Core and CSA auth bypass in November 2026 advisories

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 12:47 · coletado há 2 horas

On November 10, 2026, Ivanti published five security advisories fixing 13 vulnerabilities in Endpoint Manager (EPM), Cloud Services Application (CSA), EPMM, Sentry and User Workspace Manager (UWM). The most severe is CVE-2026-121653, a CVSS 9.8 SQL injection in the EPM Core that the article says allows unauthenticated remote code execution. CVE-2026-121683 (CVSS 9.4) is a missing-authentication flaw in CSA 5.0.8 that lets an unauthenticated attacker add and delete trusted EPM Core certificate entries. Ivanti says it is not aware of any customer exploitation, and the article reports that none of the 13 CVEs is in CISA's Known Exploited Vulnerabilities catalog. The vendor's advisories could not be retrieved during research, so the severities, versions and prerequisites below are as reported by the article and are not verified against Ivanti's own pages.

Entenda a falha

A vulnerabilidade

Ivanti's November 10, 2026 advisories fix 13 flaws. The worst is CVE-2026-121653 (CVSS 9.8), a SQL injection in the Endpoint Manager (EPM) Core that lets a remote, unauthenticated attacker achieve remote code execution. Next is CVE-2026-121683 (CVSS 9.4), missing authentication in Cloud Services Application (CSA) 5.0.8 only, which lets an unauthenticated attacker add and delete trusted EPM Core certificate entries. CVE-2026-105425 (CVSS 7.2) is an OS command injection shared by CSA and EPMM that needs admin privileges. CVE-2026-18128 (CVSS 6.8) lets a man-in-the-middle read and modify agent HTTP traffic. CVE-2026-105813 in User Workspace Manager stores data in cleartext, so a local user can steal another user's session token. Fixes: EPM 2024 SU8 and CSA 5.0.8.1. Ivanti's own advisories were not checked; details come from one article.

Como funciona

For CVE-2026-121653, a request from a remote, unauthenticated attacker reaches the EPM Core. The Core builds a database query from that input, and the injected SQL ends up giving the attacker code execution. The article does not name the endpoint or the exact steps. For CVE-2026-121683, the CSA 5.0.8 function that manages trusted EPM Core certificate entries can be called without any login, so anyone who reaches it can change which certificates are trusted. For CVE-2026-18128, an attacker positioned on the network path between agent and server can see and alter the agent's HTTP traffic. For CVE-2026-105813, session data is stored in cleartext where another local user can read it.

Por que é vulnerável

The articles give no deep root-cause analysis. By their descriptions, CVE-2026-121653 is an SQL injection in the EPM Core, meaning input is not safely handled before reaching the database. CVE-2026-121683 is a missing authentication check on a sensitive CSA function, and CVE-2026-105813 is sensitive data stored without protection. CVE-2026-105425 is command injection and requires admin rights. The articles do not explain why these went unnoticed or what exactly the patches change beyond moving to fixed versions.

Como foi descoberta

The articles do not say how most of these flaws were found. The only credit is for CVE-2026-105425, which Ivanti credits to btaol of Aquila Sec Lab. The fixes were disclosed through five Ivanti security advisories on November 10, 2026. Ivanti states it is not aware of any customers being exploited at the time of disclosure, and none of the 13 CVEs is in CISA's Known Exploited Vulnerabilities catalog.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:19.

Detalhes técnicos

  • CVE-2026-121653 (EPM Core, CVSS 9.8): SQL injection reachable without authentication, leading to remote code execution.
  • CVE-2026-121683 (CSA 5.0.8 only, CVSS 9.4): missing authentication. CSA 5.0.7 and earlier are not affected according to the article.
  • CVE-2026-18128 (CVSS 6.8): a man-in-the-middle position allows reading and modifying agent HTTP traffic.
  • CVE-2026-105425 (CVSS 7.2): OS command injection shared by CSA and EPMM; requires admin privileges. Credited by the article to btaol of Aquila Sec Lab.
  • EPMM (12.10.0.0 and earlier, 12.9.0.2 and earlier): five further medium issues, including kernel parameter changes and file deletion.
  • Sentry (10.8.2 and earlier, 10.7.3 and earlier): argument injection, path traversal and a Tomcat denial of service.
  • CVE-2026-105813 (UWM): data stored in cleartext, letting a local user steal another user's session token.

The article's severity tally (2 Critical, 1 High, 4 Medium) does not match its own text (two critical, one high and ten medium across 13 CVEs). The counts are unverified.

Remediação

  • Patch EPM to 2024 SU8 and CSA to 5.0.8.1 first, according to the article.
  • CSA: update to 5.0.8.1. Ivanti notes that a Dual NIC setup limits exposure to the internal interface.
  • EPMM: update to 12.11.0.0, 12.10.0.1 or 12.9.0.3.
  • Sentry: update to 11.0.0, 10.8.3 or 10.7.4.
  • Given Ivanti's exposure in endpoint and mobile management and the unauthenticated RCE in EPM Core, treat the EPM and CSA updates as urgent even though no exploitation is reported.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 12:47 · coletado 10/11 13:00 primeiro registro

    Ivanti fixes unauthenticated SQL injection RCE in EPM Core and CSA auth bypass in November 2026 advisories

    ler a análise desta fonte

    On November 10, 2026, Ivanti published five security advisories fixing 13 vulnerabilities in Endpoint Manager (EPM), Cloud Services Application (CSA), EPMM, Sentry and User Workspace Manager (UWM). The most severe is CVE-2026-121653, a CVSS 9.8 SQL injection in the EPM Core that the article says allows unauthenticated remote code execution. CVE-2026-121683 (CVSS 9.4) is a missing-authentication flaw in CSA 5.0.8 that lets an unauthenticated attacker add and delete trusted EPM Core certificate entries. Ivanti says it is not aware of any customer exploitation, and the article reports that none of the 13 CVEs is in CISA's Known Exploited Vulnerabilities catalog. The vendor's advisories could not be retrieved during research, so the severities, versions and prerequisites below are as reported by the article and are not verified against Ivanti's own pages.

    Technical Details

    • CVE-2026-121653 (EPM Core, CVSS 9.8): SQL injection reachable without authentication, leading to remote code execution.
    • CVE-2026-121683 (CSA 5.0.8 only, CVSS 9.4): missing authentication. CSA 5.0.7 and earlier are not affected according to the article.
    • CVE-2026-18128 (CVSS 6.8): a man-in-the-middle position allows reading and modifying agent HTTP traffic.
    • CVE-2026-105425 (CVSS 7.2): OS command injection shared by CSA and EPMM; requires admin privileges. Credited by the article to btaol of Aquila Sec Lab.
    • EPMM (12.10.0.0 and earlier, 12.9.0.2 and earlier): five further medium issues, including kernel parameter changes and file deletion.
    • Sentry (10.8.2 and earlier, 10.7.3 and earlier): argument injection, path traversal and a Tomcat denial of service.
    • CVE-2026-105813 (UWM): data stored in cleartext, letting a local user steal another user's session token.

    The article's severity tally (2 Critical, 1 High, 4 Medium) does not match its own text (two critical, one high and ten medium across 13 CVEs). The counts are unverified.

    Remediation

    • Patch EPM to 2024 SU8 and CSA to 5.0.8.1 first, according to the article.
    • CSA: update to 5.0.8.1. Ivanti notes that a Dual NIC setup limits exposure to the internal interface.
    • EPMM: update to 12.11.0.0, 12.10.0.1 or 12.9.0.3.
    • Sentry: update to 11.0.0, 10.8.3 or 10.7.4.
    • Given Ivanti's exposure in endpoint and mobile management and the unauthenticated RCE in EPM Core, treat the EPM and CSA updates as urgent even though no exploitation is reported.