# FIXTURE_ONLY test table: want_rc|args|expected substring (shared by the bash and Pester tests)
0|--product epm --version 2024SU8|PATCHED: input (epm, 2024SU8): at or above 2024 SU8, the fixed release for CVE-2026-121653 (and CVE-2026-18128).
0|--product epm --version 2024_SU9|RESULT: PATCHED (1 checked: 1 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 0 UNKNOWN)
0|--product EPM --version 2024-su12 --name core-fx-90|PATCHED: core-fx-90 (epm, 2024-su12)
0|--product csa --version 5.0.8.1|PATCHED: input (csa, 5.0.8.1): at or above the fixed build 5.0.8.1 for CVE-2026-121683.
0|--product csa --version 5.0.8.3|PATCHED: input (csa, 5.0.8.3)
0|--product csa --version 5.0.7|NOT AFFECTED: input (csa, 5.0.7): Ivanti says 5.0.7 and prior is not impacted by CVE-2026-121683.
0|--product csa --version 4.6.0.512|RESULT: NOT AFFECTED (1 checked: 0 PATCHED, 1 NOT AFFECTED, 0 VULNERABLE, 0 UNKNOWN)
0|--inventory tests/fixtures/inv_patched.csv|RESULT: PATCHED (5 checked: 3 PATCHED, 2 NOT AFFECTED, 0 VULNERABLE, 0 UNKNOWN)
0|--inventory tests/fixtures/inv_patched.csv|KEV: neither CVE listed in CISA KEV catalog 2026.11.09. Patch now regardless.
0|--inventory tests/fixtures/inv_not_affected.csv|RESULT: NOT AFFECTED (2 checked: 0 PATCHED, 2 NOT AFFECTED, 0 VULNERABLE, 0 UNKNOWN)
1|--product epm --version 2024SU7|VULNERABLE: input (epm, 2024SU7): below 2024 SU8. Ivanti lists 2024 SU7 and prior as affected by CVE-2026-121653 (and CVE-2026-18128). Update the Core to 2024 SU8 from ILS.
1|--product epm --version 2024|VULNERABLE: input (epm, 2024): below 2024 SU8.
1|--product epm --version 2024GA|VULNERABLE: input (epm, 2024GA)
1|--product epm --version 2022SU6|VULNERABLE: input (epm, 2022SU6): older than the 2024 branch. The CVE record says affected before 2024 SU8 and Ivanti's only fix is 2024 SU8.
3|--product endpoint_manager --version 2024SU8|UNKNOWN: input (endpoint_manager, 2024SU8): product not recognised
1|--product csa --version 5.0.8|VULNERABLE: input (csa, 5.0.8): 5.0.8 is the only affected version for CVE-2026-121683. Update to 5.0.8.1. Until then, Ivanti says a Dual NIC setup limits exposure to the internal interface.
1|--product csa --version 5.0.8.0|VULNERABLE: input (csa, 5.0.8.0)
1|--inventory tests/fixtures/inv_mixed.csv|RESULT: VULNERABLE (7 checked: 2 PATCHED, 0 NOT AFFECTED, 3 VULNERABLE, 2 UNKNOWN)
1|--inventory tests/fixtures/inv_mixed.csv|VULNERABLE: 198.51.100.20 (epm, 2022 SU6)
1|--inventory tests/fixtures/inv_mixed.csv|UNKNOWN: ws-fx-13 (epm, 11.0.7.1234): not an EPM release name this pack can judge (use the form 2024 SU8). Build numbers are not mapped.
1|--inventory tests/fixtures/inv_mixed.csv|UNKNOWN: 203.0.113.30 (csa, 5.1.0): above 5.0.8.x, a version Ivanti's advisory does not list. Confirm with Ivanti.
1|--inventory tests/fixtures/inv_crlf.csv|VULNERABLE: core-fx-21 (epm, 2024SU5)
1|--inventory tests/fixtures/inv_crlf.csv|PATCHED: csa-fx-21 (csa, 5.0.8.2)
1|--inventory tests/fixtures/inv_edges.csv|RESULT: VULNERABLE (11 checked: 2 PATCHED, 1 NOT AFFECTED, 3 VULNERABLE, 5 UNKNOWN)
1|--inventory tests/fixtures/inv_edges.csv|UNKNOWN: core-fx-33 (epm, 2025 SU1): a release year after 2024 that Ivanti's November 2026 advisory does not cover.
1|--inventory tests/fixtures/inv_edges.csv|UNKNOWN: core-fx-34 (epm, no version): no version given.
1|--inventory tests/fixtures/inv_edges.csv|UNKNOWN: core-fx-35 (sentry, 2024 SU8): product not recognised (use epm or csa).
1|--inventory tests/fixtures/inv_edges.csv|UNKNOWN: csa-fx-33 (csa, not-a-version): not a CSA version this pack can judge (use the form 5.0.8.1).
1|--inventory tests/fixtures/inv_edges.csv|PATCHED: name not given (csa, 5.0.8.1)
1|--inventory tests/fixtures/inv_edges.csv|PATCHED: core-fx-36 (epm, 2024 su 10)
1|--inventory tests/fixtures/inv_edges.csv|NOT AFFECTED: csa-fx-34 (csa, 05.00.007)
1|--inventory tests/fixtures/inv_edges.csv|VULNERABLE: core-fx-32 (epm, 2024 GA)
3|--product csa --version 5.0.9|UNKNOWN: input (csa, 5.0.9): above 5.0.8.x, a version Ivanti's advisory does not list. Confirm with Ivanti.
3|--product csa --version 203.0.113.5|UNKNOWN: input (csa, 203.0.113.5)
3|--product epm --version 2026SU1|RESULT: UNKNOWN (1 checked: 0 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 1 UNKNOWN)
3|--product epm --version 11.0.7.1234|UNKNOWN: input (epm, 11.0.7.1234): not an EPM release name
3|--product epm --version 2024SU|UNKNOWN: input (epm, 2024SU)
3|--product sentry --version 2024SU8|UNKNOWN: input (sentry, 2024SU8): product not recognised (use epm or csa).
3|--inventory tests/fixtures/inv_unknown.csv|RESULT: UNKNOWN (2 checked: 0 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 2 UNKNOWN)
4||Usage: check-ivanti-epm-csa.sh --product epm|csa --version VER [--name NAME]
4|--product epm|Exit: 0 PATCHED or NOT AFFECTED, 1 VULNERABLE, 3 UNKNOWN, 4 usage or read error
4|--version 2024SU8|Usage:
4|--product epm --version 2024SU8 --inventory tests/fixtures/inv_mixed.csv|Usage:
4|--inventory tests/fixtures/inv_mixed.csv --name x|Usage:
4|--bogus x|Usage:
4|--inventory tests/fixtures/inv_bad_header.csv|ERROR: CSV header must be: name,product,version
4|--inventory tests/fixtures/inv_header_only.csv|ERROR: inventory has no data rows: tests/fixtures/inv_header_only.csv
4|--inventory tests/fixtures/does_not_exist.csv|ERROR: cannot read inventory file: tests/fixtures/does_not_exist.csv
