Are your Ivanti EPM Core and CSA exposed to CVE-2026-121653?
Ivanti published two Critical flaws on 10 November 2026. CVE-2026-121653 (CVSS 9.8) is SQL injection in the Endpoint Manager Core that gives an unauthenticated attacker code execution. CVE-2026-121683 (CVSS 9.4) lets an unauthenticated attacker change trusted EPM Core certificates on Cloud Services Application 5.0.8. Update to EPM 2024 SU8 and CSA 5.0.8.1.
No evidence of exploitation in the wild (Ivanti). Not in CISA KEV
Ivanti says: "We have no evidence of these vulnerabilities being exploited in the wild." Neither CVE was in CISA's Known Exploited Vulnerabilities catalogue when we checked at 17:07 GMT on 10 November 2026 (catalogue 2026.11.09). CVE-2026-121653 needs no login and gives code execution on the EPM Core, the server that manages your endpoints. Update now, before that changes.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 18:05 GMT.
At a Glance
Based on Ivanti's advisories, the CVE records and CISA as of 10 November 2026. Last updated 10 November 2026, 18:05 GMT.
CVSS 9.8 and 9.4
Both rated Critical by Ivanti, which publishes the CVE records.
No known exploitation
Ivanti has no evidence of exploitation in the wild. Not in CISA KEV when checked on 10 November.
EPM Core and CSA
EPM 2024 SU7 and prior. CSA 5.0.8 only.
EPM 2024 SU8, CSA 5.0.8.1
EPM 2024 SU8 is in ILS. CSA 5.0.8.1 is linked from Ivanti's CSA advisory.
Ivanti publishes its EPM and CSA advisories and the November 2026 Security Update.
Ivanti, as the CVE authority, publishes CVE-2026-121653 and CVE-2026-121683, both Critical.
Ivanti: no evidence of exploitation in the wild. Neither CVE is in CISA KEV (catalogue 2026.11.09).
Update EPM to 2024 SU8 and CSA to 5.0.8.1, and keep both off the internet.
Affected and fixed versions
| CVE | CVSS | Product | What Ivanti says | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-121653 | 9.8 Critical | Ivanti Endpoint Manager (EPM) Core | SQL injection (CWE-89). A remote unauthenticated attacker can achieve remote code execution. | 2024 SU7 and prior | 2024 SU8 (in ILS) |
| CVE-2026-121683 | 9.4 Critical | Ivanti Cloud Services Application (CSA) | Missing authentication (CWE-306). A remote unauthenticated attacker can add and delete arbitrary trusted EPM Core certificate entries. | 5.0.8 only (5.0.7 and prior not impacted) | 5.0.8.1 |
Descriptions and versions follow Ivanti's advisories. Ivanti shows CVSS 3.0 vectors; the CVE records show CVSS 3.1 with the same metrics and scores. NVD lists both as Received and has not given its own score.
Scanner warning: the CSA CVE record disagrees with itself
The structured affected data in the CVE record for CVE-2026-121683 marks version 5.0.8 as unaffected and everything else as affected. That contradicts the record's own description (version 5.0.8 is vulnerable) and Ivanti's advisory (5.0.8 only, fixed in 5.0.8.1, 5.0.7 and prior not impacted). We follow the advisory. Scanners that read only that structured field may get CSA versions wrong, so check CSA versions by hand.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Ivanti's advice and our advice are labelled separately.
Update and restrict
- Ivanti: update EPM to 2024 SU8 (available in ILS).
- Ivanti: update CSA 5.0.8 to 5.0.8.1. CSA 5.0.7 and prior is not impacted.
- Ivanti: run CSA with a Dual NIC configuration, which limits exposure to the internal interface.
- Our advice: keep the EPM Core off the internet so only the CSA faces it, and inventory every Core you run for clients.
Hunt and contain
- Our advice: review EPM Core database and web logs for unusual SQL errors.
- Our advice: look for unexpected processes spawned by the EPM Core services.
- Our advice: review the CSA trusted EPM Core certificate entries by hand, and hunt back to before 10 November.
- Our advice: if you find any, isolate the Core, keep the logs and rotate credentials it holds.
Proactive: Update and Restrict
Ivanti's fixes first, then our advice to reduce exposure.
Update EPM to 2024 SU8
Ivanti: update Ivanti EPM to 2024 SU8, available in ILS. EPM 2024 SU7 and prior are affected by CVE-2026-121653. See the EPM advisory.
Update CSA to 5.0.8.1
Ivanti: update Ivanti CSA to 5.0.8.1. Only CSA 5.0.8 is affected by CVE-2026-121683; 5.0.7 and prior is not impacted. See the CSA advisory.
Use a Dual NIC CSA configuration
Ivanti: if CSA is running with a Dual NIC configuration per Ivanti's documented best practices, the exposure is limited to the internal interface and cannot be exploited externally. Use this to reduce exposure, not instead of updating.
Keep the EPM Core off the internet
Our advice: make sure the EPM Core web services and database are not reachable from the internet, so that only the CSA faces it, and expose CSA only through its external interface as designed. Check firewall NAT rules and cloud security groups across every client.
Inventory every Core and CSA
Our advice: list every EPM Core and CSA you run, for yourself and for clients, with its version and whether it was reachable from untrusted networks. Anything reachable before the update should be hunted.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check versions offline and hunt for signs of misuse. Everything is read-only.
check-ivanti-epm-csa.sh
Read-only offline checker. It compares the EPM release or CSA version you give it, or a CSV inventory, against Ivanti's affected and fixed versions. It never contacts an EPM Core or CSA. EPM build numbers are not mapped to SU releases, so give the release name (for example 2024 SU7).
bash check-ivanti-epm-csa.sh --product epm --version "2024 SU7"
bash check-ivanti-epm-csa.sh --product csa --version 5.0.8 --name client-a-csa
# Whole estate, from an inventory (name,product,version)
bash check-ivanti-epm-csa.sh --inventory inventory.csvCheck-IvantiEpmCsa.ps1
The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-IvantiEpmCsa.ps1 -Inventory inventory.csvKQL and Sigma
16 KQL hunts for Microsoft Sentinel and Defender (Q1 to Q6, Q6b and Q7 to Q15): EPM and CSA inventory and exposure, HTTP 500 bursts and public requests to the Core, SQL Server errors and xp_cmdshell, shells from SQL Server, IIS or the Core folder, new web scripts in the Core folder, new outbound destinations, and CSA certificate log lines. 5 Sigma rules cover shells from SQL Server, IIS and the Core folder, xp_cmdshell changes and web scripts in the Core folder; they are in the full pack. Every hunt is our own pattern. None of the KQL has been run against a live tenant yet.
Verdicts
- PATCHEDEPM 2024 SU8 or later SU; CSA 5.0.8.1.
- NOT AFFECTEDCSA 5.0.7 and prior (Ivanti).
- VULNERABLEEPM 2024 SU7 or earlier; CSA 5.0.8.
- UNKNOWNEPM build numbers, releases Ivanti does not list, unknown products or missing versions.
Exit codes
| Code | Meaning |
|---|---|
| 0 | All PATCHED or NOT AFFECTED |
| 1 | Any VULNERABLE |
| 3 | Any UNKNOWN, none vulnerable |
| 4 | Usage or read error |
Exit code 2 is not used. Both checkers also print the CISA KEV status.
Know the limits
- Both checkers are read-only and offline. They only compare version strings or a CSV you give them, send no network traffic, write nothing and contain no exploit payloads.
- Ivanti has published no indicators of compromise, so the pack contains none. Every hunt is our own pattern.
- None of the KQL has been run against a live tenant. Unverified: how Defender names EPM in its software list, whether SQL Server errors reach the Application log, whether CSA logs trusted certificate changes (Q14 keywords), and the Core and CSA ports, which are placeholders. Review CSA certificate entries by hand.
- One Sigma rule (xp_cmdshell option changed) does not convert with the Microsoft pipelines; use KQL Q8 instead, as the README explains.
What is in the pack
| File | What it does |
|---|---|
| check-ivanti-epm-csa.sh | Offline checker for Linux and macOS (bash) |
| Check-IvantiEpmCsa.ps1 | The same checker in PowerShell 7 |
| KQL (16 hunts) | Microsoft Sentinel and Defender hunts Q1 to Q15, including Q6b |
| Sigma (5 rules) | Windows process and file rules, plus Kusto conversions (in the full pack) |
| tests/ | Fixtures, bash and Pester tests and a sandboxed no-network run |
| README.md | Verified facts, Ivanti advice versus ours, limits and usage (in the full pack) |
Reactive: How to Hunt (Our Advice)
Ivanti has published no indicators of compromise. These hunts are CybaVerse advice. CybaOps can run them across your estate or your clients'.
Unusual SQL errors
Review EPM Core database and web logs for unusual SQL errors, malformed requests or spikes in errors from unfamiliar sources. CVE-2026-121653 is SQL injection in the Core.
Unexpected processes from the Core
Look for unexpected child processes spawned by the EPM Core services or its database, such as command shells or PowerShell, and for new services or scheduled tasks on the Core server.
Unknown trusted certificate entries in CSA
Review the CSA trusted EPM Core certificate entries by hand for entries you do not recognise, or for entries that have been removed. CVE-2026-121683 lets an unauthenticated attacker add and delete them. We could not confirm that CSA logs these changes.
Unexpected changes to managed endpoints
Look for software deployments, scripts or policy changes pushed from the EPM Core that nobody scheduled. Code execution on the Core can reach every managed device.
If you find signs of misuse (our advice)
- Isolate the EPM Core or CSA by restricting network access. Keep it powered and keep the logs.
- Rotate credentials the Core holds, including service, database and deployment accounts.
- Remove trusted certificate entries you cannot explain and review what they allowed.
- Contact Ivanti support, and update to EPM 2024 SU8 and CSA 5.0.8.1 on a known-good build.
Updated does not mean clean
Updating stops new use of these flaws. It does not undo code already run on the Core, deployments already pushed or certificate entries already changed. Hunt the period before you updated.
Ivanti EPM and CSA November 2026 FAQ
Short answers based on Ivanti's advisories and the CVE records as of 10 November 2026.
What did Ivanti publish on 10 November 2026?
Ivanti's November 2026 Security Update discloses vulnerabilities in five products. This guide covers two Critical ones: CVE-2026-121653 in the Endpoint Manager (EPM) Core and CVE-2026-121683 in Cloud Services Application (CSA). Ivanti says these vulnerabilities do not impact any other Ivanti solutions. The other products have their own advisories, linked from Ivanti's blog.
What is CVE-2026-121653?
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8, which allows a remote unauthenticated attacker to achieve remote code execution. Ivanti scores it 9.8 Critical (CWE-89). Ivanti lists EPM 2024 SU7 and prior as affected and 2024 SU8 as the fix.
What is CVE-2026-121683?
Missing authentication in Ivanti Cloud Services Application version 5.0.8, which allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries. Ivanti scores it 9.4 Critical (CWE-306). Ivanti says only 5.0.8 is affected, 5.0.7 and prior are not impacted, and 5.0.8.1 resolves it.
Is either being exploited, or in CISA KEV?
Ivanti's blog says: We have no evidence of these vulnerabilities being exploited in the wild. Its advisories say Ivanti is not aware of any customers being exploited at the time of disclosure, and that both were disclosed through its responsible disclosure program. Neither CVE was in CISA's Known Exploited Vulnerabilities catalogue when we checked at 17:07 GMT on 10 November 2026, but that catalogue (2026.11.09) was released on 9 November, before this disclosure, so recheck it. A KEV due date would apply only to US federal agencies. Patch now regardless.
How do we fix EPM?
Ivanti says to update to Ivanti EPM 2024 SU8, available in the Ivanti License System (ILS). The same update also fixes a Medium severity agent issue, CVE-2026-18128, listed in the same advisory.
How do we fix CSA?
Ivanti says to update to Ivanti CSA 5.0.8.1. CSA 5.0.7 and prior is not impacted. Check which version each CSA runs before you plan the change.
Is there a workaround for CSA?
Ivanti says that if CSA is running with a Dual NIC configuration per its documented best practices, the exposure is limited to the internal interface and cannot be exploited externally. That reduces exposure from the internet. It does not remove the need to update to 5.0.8.1. Ivanti lists no workaround for EPM.
Why might our scanner get CSA versions wrong?
The structured affected data in the CVE record for CVE-2026-121683 marks 5.0.8 as unaffected, which contradicts the record's own description and Ivanti's advisory. We follow the advisory: 5.0.8 only is affected and 5.0.8.1 fixes it. Scanners that read only that field may report CSA versions wrongly.
Why do the CVSS vectors look different between sources?
Ivanti's advisories show the vectors in CVSS 3.0 format, while the CVE records show CVSS 3.1. The scores are the same in both: 9.8 for CVE-2026-121653 and 9.4 for CVE-2026-121683.
Are there indicators of compromise?
No. Ivanti says there is no known public exploitation that could be used to provide a list of indicators of compromise. The hunts on this page are our advice, based on what each flaw affects.
Who is this relevant to?
MSPs and IT teams that run Ivanti Endpoint Manager, especially where the EPM Core or CSA is reachable from the internet or from untrusted networks. EPM manages endpoints at scale, so code execution on the Core is a route to every managed device.
Protect Your Endpoint Management, and Your Clients'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Ivanti: November 2026 Security Update (10 November 2026)
- Ivanti: Security Advisory Ivanti Endpoint Manager (EPM) November 2026
- Ivanti: Security Advisory Ivanti CSA (CVE-2026-121683)
- CVE record: CVE-2026-121653 (published by Ivanti, 10 November 2026)
- CVE record: CVE-2026-121683 (published by Ivanti, 10 November 2026)
- NVD: CVE-2026-121653
- NVD: CVE-2026-121683
- CISA: Known Exploited Vulnerabilities catalogue (checked 10 November 2026, 17:07 GMT; catalogue 2026.11.09)
Related threat guides: GLPI unauthenticated SQL injection and ConnectWise cloud backup compromise. All threat guides.