Ivanti security advisories, November 2026

Every Ivanti security advisory published in November 2026, from Ivanti Security Advisories, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 15
Critical: 2
High: 2
In CISA KEV: 1
CVEs: 14

Ivanti advisories published in November 2026

Nov 10, 2026
Critical [CVE-2026-121683] Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries
Critical9.4
Nov 10, 2026
Critical [CVE-2026-121653] SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution
Critical9.8
Nov 10, 2026
High [CVE-2026-105425] OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution
High7.2
Nov 10, 2026
High November 2026 Security Update
HighExploited
Nov 10, 2026
Medium [CVE-2026-83528] Endpoint Manager Mobile: Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information
Medium4.9
Nov 10, 2026
Medium [CVE-2026-107405] Endpoint Manager Mobile: exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service
Medium5.5
Nov 10, 2026
Medium [CVE-2026-107404] Endpoint Manager Mobile: Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk
Medium4.9
Nov 10, 2026
Medium [CVE-2026-105427] Endpoint Manager Mobile: Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service
Medium4.9
Nov 10, 2026
Medium [CVE-2026-105426] Endpoint Manager Mobile: Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root
Medium6.7
Nov 10, 2026
Medium [CVE-2026-123181] path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges
Medium5.5
Nov 10, 2026
Medium [CVE-2026-123179] insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local authenticated attacker to cause a denial of service
Medium5.5
Nov 10, 2026
Medium [CVE-2026-105669] Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries
Medium6.7
Nov 10, 2026
Medium [CVE-2026-18128] Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic
Medium6.8
Nov 10, 2026
Medium [CVE-2026-105813] User Workspace Manager: Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token
Medium6.3
Nov 3, 2026
Medium [CVE-2026-118527] Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk
Medium4.3ExploitedCISA KEV

Get an email when Ivanti publishes the next one.

See Ivanti's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Ivanti

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.