Ivanti patches 13 flaws across Sentry, EPMM and Endpoint Manager

Ivanti patches 13 flaws across Sentry, EPMM and Endpoint Manager

10 November 2026: Ivanti's November update fixes 13 vulnerabilities in five products, two of them rated critical and one high, which could let a remote attacker run code or add and delete trusted certificates on the systems affected. Ivanti says it has "no evidence of these vulnerabilities being exploited in the wild".

Not yet independently verified. Ivanti's per-product advisory pages on its customer hub did not load for us, so the count of 13 flaws, the severity split and the fixed versions below come from Italy's ACN summary of those advisories; which of the three listed CVEs belongs to which product is taken from the advisory titles ACN links to. We will update this when it can be confirmed, and remove this note.

Five products, four with version fixes

The vendor's blog post of 10 November names Ivanti User Workspace Manager, Ivanti Sentry, Ivanti Endpoint Manager Mobile (EPMM), Ivanti Cloud Services Application (CSA) and Ivanti Endpoint Manager (EPM), and says no other Ivanti product is affected. Italy's national cybersecurity agency, ACN, summarised the advisories on 11 November and lists these affected versions:

• Sentry: 10.8.x before 10.8.3, and 10.7.x before 10.7.4
• EPMM: 12.10.x before 12.10.0.1, and 12.9.x before 12.9.0.3
• Cloud Services Application: version 5.0.8
• Endpoint Manager: versions before 2024 SU8

User Workspace Manager is named in Ivanti's post but carries no version line in ACN's summary, so its fix has to be read from Ivanti's own advisory for that product.

The three serious flaws

ACN lists only the critical and high issues by number: CVE-2026-121683, CVE-2026-121653 and CVE-2026-105425. The titles of Ivanti's advisories place CVE-2026-121683 in Cloud Services Application and CVE-2026-105425 in Sentry, the gateway that sits between mobile devices and back-end systems; the Sentry advisory also covers CVE-2026-105669, CVE-2026-123179 and CVE-2026-123181. ACN describes the effects in two groups, arbitrary code execution and the ability to add and delete trusted certificates at will. On a device-management estate the second matters as much as the first, because a planted trusted certificate lets an attacker pass as a legitimate server to every managed device that relies on that store.

CSA, the appliance some customers still run in front of older Ivanti deployments, is listed at a single version, 5.0.8, rather than a range, which suggests the fix lands in a release after it.

Why Ivanti expects more of these

The post spends as long on method as on the fixes. Ivanti says its engineering and product security red teams have "integrated multiple advanced LLM models" into their testing, that these found flaws traditional static and dynamic scanners had missed, "including some that we are disclosing today", and that it expects "an increase in vulnerability disclosures" as the tools are refined. It also says a human stays in the loop to verify automated or agentic work.

For an Ivanti customer that is a planning point rather than a reason for alarm: monthly Ivanti updates are likely to get longer, so the patch window for Sentry and EPMM, both of which face the internet in most deployments, is worth agreeing before the next one arrives.

Where the detail sits

The full advisories, with CVSS scores and the exact fixed builds for each product, are on the Ivanti Innovators Hub, which needs a customer login for support cases but publishes advisories openly. Ivanti also offers a security advisory RSS feed for anyone who wants the December release the day it lands.

Related on TrustList:

• Apple will limit Rosetta to older games from macOS 28 onwards
• Intune drops legacy Apple setup and update options in release 2610
• Apple backports fix for possibly exploited CoreGraphics bug to iOS 18

Sources

• Ivanti: November 2026 Security Update (blog), 10 November 2026, 10 November 2026
• Agenzia per la Cybersicurezza Nazionale (Italy): Ivanti November Security Update, 11 November 2026, 11 November 2026
• Ivanti Innovators Hub: Security Advisory Ivanti Sentry (CVE-2026-105425, CVE-2026-105669, CVE-2026-123179, CVE-2026-123181) (read 11 November 2026), 11 November 2026
• Ivanti Innovators Hub: Security Advisory Ivanti CSA (CVE-2026-121683) (read 11 November 2026), 11 November 2026