Ivanti has released its November 2026 security updates, fixing 13 vulnerabilities across five products, and enterprise administrators should put two of them at the top of the patch queue. The most severe flaw is a SQL injection vulnerability in the Core of Ivanti Endpoint Manager that allows a remote attacker to achieve remote code execution without any authentication at all.
The flaw, tracked as CVE-2026-121653, carries a CVSS score of 9.8 out of 10. It affects Endpoint Manager 2024 SU7 and earlier, and it is fixed in the 2024 SU8 release, which Ivanti makes available through the Ivanti License System. The same Endpoint Manager update also fixes CVE-2026-18128, a medium-severity issue rated 6.8 in which sensitive agent information is transmitted in cleartext, allowing an attacker positioned between communicating systems to read or modify HTTP traffic.
The second critical flaw sits in a companion product. CVE-2026-121683, rated 9.4, is a missing-authentication vulnerability in Ivanti Cloud Services Application version 5.0.8. A remote, unauthenticated attacker can use it to add and delete arbitrary trusted Endpoint Manager Core certificate entries, a capability that could undermine trust between the cloud service and the management core it connects to. Only version 5.0.8 is affected, and Ivanti says versions 5.0.7 and earlier are not. The fix is CSA 5.0.8.1. Ivanti also notes that following its dual network interface guidance, which limits exposure on the internal interface, can reduce external risk, but it does not replace patching.
The remaining updates cover the rest of the endpoint management stack. Endpoint Manager Mobile fixes six vulnerabilities, including CVE-2026-105425, a high-severity operating system command injection flaw rated 7.2 that allows remote administrators to execute code, and that same flaw also affects Ivanti Sentry. Other Endpoint Manager Mobile issues allow administrators to set Linux kernel parameters as root, permanently disable Apache HTTPS services, delete arbitrary files, and expose personal information protected under GDPR. Fixed releases are 12.11.0.0, 12.10.0.1, and 12.9.0.3.
Sentry, Ivanti's mobile gateway product, fixes additional flaws beyond the shared command injection issue, including an argument injection vulnerability that lets remote administrators execute existing binaries on disk, a local denial-of-service issue in the Tomcat shutdown listener, and a flaw that permits remote administrators to create arbitrary files and directories as root. Its fixed releases include 11.0.0, 10.8.3, and 10.7.4. User Workspace Manager closes the set with a medium-severity cleartext storage flaw that could let a local authenticated attacker retrieve another local user's session, fixed in the 2026.4 release.
Ivanti said the vulnerabilities were reported through responsible disclosure and that it is not aware of any customers being exploited before publication. None of the flaws is listed in CISA's Known Exploited Vulnerabilities catalog, and Ivanti supplied no indicators of compromise. That clean starting position, however, rarely lasts for management infrastructure. Endpoint Manager servers are high-value targets precisely because they hold trusted connections to large fleets of managed devices, and previous Endpoint Manager SQL injection flaws have drawn sustained attacker attention.
For security teams already working through a heavy Patch Tuesday, the practical order is clear. Update internet-facing or otherwise exposed Endpoint Manager cores to 2024 SU8 first, move Cloud Services Application installations on 5.0.8 to 5.0.8.1 next, and then complete the Endpoint Manager Mobile, Sentry, and User Workspace Manager updates. Administrators should also verify the installed version after updating, because restricted administrator access does not mitigate the two unauthenticated critical flaws.