CriticalCVE
Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager
Cyber Security News·Source published ·1 min read
What happened?
Ivanti has released security updates for Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Application, and User Workspace Manager. The November 2026 disclosures cover flaws that could allow remote code execution, changes to trusted certificates, data exposure, and service disruption. Two critical vulnerabilities in Endpoint Manager and CSA present the highest risks. Ivanti said it was not aware of customers being exploited through these vulnerabilities before public disclosure. The issues were reported through its responsible disclosure program.
Key details
- SQL injection in Endpoint Manager allows unauthenticated remote code execution.
- CSA missing authentication lets attackers add or delete trusted certificate entries.
- EPMM command injection with admin privileges allows remote code execution.
- Sentry argument injection lets remote admins execute disk binaries.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.