[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqRF6fMVmFv_0hUU8yMNpzMmu_SCikbOT9ui-r2kjCDw":3},{"article":4,"iocs":39,"watch_terms":80,"solutions":81,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"37265cd4-a6ce-4501-b992-38c51393a945","Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager","ivanti-patches-new-security-flaws-affecting-endpoint-manager-epmm-sentry-csa-and-2725aa","Ivanti has released security updates for Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Application, and User Workspace Manager. The November 2026 disclosures cover flaws that could allow remote code execution, changes to trusted certificates, data exposure, and service disruption. Two critical vulnerabilities in Endpoint Manager and CSA present the highest risks. Ivanti said it […] The post Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager appeared first on Cyber Security News.","Ivanti has issued security updates for several products, including Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager, to address multiple vulnerabilities. Two critical flaws in Endpoint Manager and CSA could allow remote code execution and unauthorized certificate changes, with CVSS scores of 9.8 and 9.4 respectively. While Ivanti is not aware of any active exploitation, patching is strongly recommended, especially for unauthenticated vulnerabilities.","Ivanti releases updates for multiple products addressing critical vulnerabilities including RCE and data exposure.","https:\u002F\u002Fcybersecuritynews.com\u002Fivanti-security-flaws\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FIvanti-Security-Flaws.webp","2026-11-10T16:43:58+00:00","2026-11-10T17:00:27.276468+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Ivanti","vendor",{"name":21,"type":22},"Endpoint Manager","product",{"name":24,"type":22},"Endpoint Manager Mobile",{"name":26,"type":22},"Sentry",{"name":28,"type":22},"Cloud Services Application",{"name":30,"type":22},"User Workspace Manager","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},[40,44,47,50,53,56,59,62,65,68,71,74,77],{"type":41,"value":42,"context":43},"cve","CVE-2026-121653","SQL injection vulnerability in Endpoint Manager Core before version 2024 SU8 allowing remote code execution.",{"type":41,"value":45,"context":46},"CVE-2026-18128","Endpoint Manager vulnerability allowing sensitive information to travel in cleartext.",{"type":41,"value":48,"context":49},"CVE-2026-121683","Critical vulnerability in CSA version 5.0.8 allowing remote attackers to add or delete arbitrary trusted EPM Core certificate entries.",{"type":41,"value":51,"context":52},"CVE-2026-105425","EPMM vulnerability allowing remote attackers with administrator privileges to execute code through operating system command injection.",{"type":41,"value":54,"context":55},"CVE-2026-105426","EPMM vulnerability allowing administrators to change Linux kernel settings as root.",{"type":41,"value":57,"context":58},"CVE-2026-105427","EPMM vulnerability allowing administrators to disable Apache HTTPS services.",{"type":41,"value":60,"context":61},"CVE-2026-107404","EPMM vulnerability allowing administrators to delete arbitrary files.",{"type":41,"value":63,"context":64},"CVE-2026-83528","EPMM vulnerability allowing administrators to expose protected personal information.",{"type":41,"value":66,"context":67},"CVE-2026-107405","EPMM local flaw causing denial of service.",{"type":41,"value":69,"context":70},"CVE-2026-105669","Sentry argument injection flaw letting remote administrators execute existing disk binaries.",{"type":41,"value":72,"context":73},"CVE-2026-123179","Sentry local authenticated attacker flaw disrupting service through the Tomcat shutdown listener.",{"type":41,"value":75,"context":76},"CVE-2026-123181","Sentry flaw letting remote administrators create arbitrary files and directories with root privileges.",{"type":41,"value":78,"context":79},"CVE-2026-105813","User Workspace Manager cleartext storage flaw allowing a local authenticated attacker to retrieve another local user’s session.",[18,21,24],{"controls":82,"vendors":165},[83,112,136],{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,121,128],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":113,"product_name":118,"url":119,"description":120},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":122,"vendor_name":18,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":137,"name":138,"problem":139,"products":140},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[141,149,157],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[166],{"slug":122,"name":18,"logo_path":123,"roles":167},[168],"affected",{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":179},"critical-ivanti-vulnerabilities-demand-urgent-patching-across-multiple-products","Critical Ivanti Vulnerabilities Demand Urgent Patching Across Multiple Products","Ivanti has disclosed multiple high-severity vulnerabilities across five products, including two critical flaws with CVSS scores of 9.8 and 9.4 that could enable remote code execution and unauthorized certificate manipulation without authentication. The breadth of affected products — Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager — highlights the risk of running enterprise management platforms with unpatched vulnerabilities, as these systems often have broad access to corporate networks. Unauthenticated remote code execution vulnerabilities are especially dangerous because attackers require no credentials to exploit them, dramatically lowering the barrier to compromise. Organizations relying on Ivanti products must treat these updates as urgent, given Ivanti's history of being a high-value target for nation-state and ransomware actors.",[174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"CIS Control 7: Continuous Vulnerability Management (v8)":182,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":183,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":184},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling, obligating operators of essential services to have processes for rapidly addressing critical vendor-disclosed vulnerabilities like these Ivanti flaws.","SI-2 mandates that organizations identify, report, and correct information system flaws within defined timeframes, directly addressing the need to promptly apply Ivanti's critical security updates.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which would have ensured timely detection and patching of these critical Ivanti flaws before exploitation could occur.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly covering the obligation to assess and patch the critical Ivanti vulnerabilities disclosed here.","This category requires organizations to act on newly disclosed vulnerabilities, which is precisely what is needed in response to Ivanti's disclosure of these unauthenticated remote code execution flaws."]