The Ivanti November 2026 security update covers five product families, but it is not one unauthenticated remote-code-execution event. Ivanti’s advisories separate three unauthenticated remote paths from the admin-only and local scenarios; one of those three also requires a man-in-the-middle position and user interaction.
Cloud Services Application and Endpoint Manager contain the critical unauthenticated flaws. Endpoint Manager Mobile, Sentry, and User Workspace Manager require existing access or a more constrained position for their published attack paths.
Ivanti November 2026 Security Update Matrix
Use the matrix as an inventory and maintenance guide. “Remote” does not mean “unauthenticated,” and each fixed release must be matched to its supported product branch.
- Affected
- Fixed
Ivanti says CSA 5.0.7 and earlier are not affected by CVE-2026-121683. It also says CVE-2026-105813 affects only UWM Neurons Hybrid, not UWM on-premise or Ivanti Neurons for App Control.
Teams maintaining several Ivanti products should track each branch through a documented vulnerability management process. A single “Ivanti patched” status can hide an uncorrected appliance or older branch.
Which Ivanti Flaws Need Network Access Only?
CVE-2026-121653 is the most direct remote-code-execution path in this release. Ivanti describes SQL injection in EPM Core before 2024 SU8 that lets a remote unauthenticated attacker achieve code execution.
CSA 5.0.8 has CVE-2026-121683, a missing-authentication flaw scored 9.4 under CVSS 3.0. Ivanti says it lets a remote unauthenticated attacker add or delete trusted EPM Core certificate entries.
EPM also includes CVE-2026-18128, scored 6.8 under CVSS 3.0. Its path requires a man-in-the-middle position and user interaction to read or alter HTTP traffic, so it differs from the EPM Core SQL injection.
Prioritize internet-reachable CSA 5.0.8 and EPM Core installations before admin-only paths. Use an external attack surface inventory to find forgotten or unexpectedly exposed management systems.
Where Do Existing Privileges Change the Risk?
EPMM’s six CVEs include one high-severity and five medium-severity flaws. The high-severity CVE-2026-105425 is command injection, but Ivanti requires a remote authenticated administrator for code execution.
The remaining EPMM paths cover kernel parameter changes, HTTPS denial of service, arbitrary file deletion, local denial of service, and protected user-information exposure. Most require remote admin privileges, while CVE-2026-107405 requires local low-privilege access.
Sentry shares CVE-2026-105425 and adds an admin-only argument injection, an admin-only path traversal, and a local denial-of-service flaw. The fixed branches are 11.0.0, 10.8.3, and 10.7.4.
UWM’s CVE-2026-105813 requires local authenticated access and can expose another local user’s session token. Its scope and prerequisite make it different from the network-reachable CSA and EPM findings.
What Does Ivanti Say About Exploitation and Risk?
Ivanti says it had no evidence of these vulnerabilities being exploited in the wild at disclosure. The five product advisories also say Ivanti was not aware of customers being exploited before public disclosure.
Brandefense Blackhole recorded 163 Ivanti-related posts from August 12 through November 10, including 86 on Telegram and 11 on forums. This is broad brand chatter, not proof of exploitation or discussion of any specific CVE.
The volume supports monitoring for changing claims after disclosure, especially around the two unauthenticated products. Teams should validate any claim against vendor evidence before changing incident status or patch priority.
How Should Teams Order the Five Product Updates?
- Map every product and branchIdentify CSA, EPM, EPMM, Sentry, and UWM installations before the maintenance window.
- Patch unauthenticated pathsMove CSA 5.0.8 to 5.0.8.1 and EPM to 2024 SU8 first, especially when reachable from untrusted networks.
- Update the mobile stackApply an Ivanti-supported fixed branch to EPMM and Sentry rather than assuming one version fits every branch.
- Correct hybrid UWMMove affected UWM Neurons Hybrid deployments to 2026.4.
- Preserve and review evidenceRetain authentication, administrator, application, and system logs before maintenance.
- Verify the resultRecord the installed version, service health, exposure state, and test result for each product.
Ivanti directs customers to its download portals or ILS for the corrected builds. Follow the applicable advisory and supported upgrade path, then confirm the running version rather than relying only on a completed installer.
Review unexpected administrator actions, certificate changes, configuration changes, file operations, and service disruption around exposed systems. If those checks show suspicious activity, preserve evidence and activate the organization’s incident response plan.
Frequently Asked Questions
Which Ivanti November 2026 flaws are unauthenticated?
Ivanti describes CVE-2026-121683 in CSA and CVE-2026-121653 in EPM Core as remotely reachable without authentication. EPM also has a separate MITM flaw.
Which versions fix the Ivanti EPMM vulnerabilities?
Ivanti lists EPMM 12.11.0.0, 12.10.0.1, and 12.9.0.3 as the fixed releases for their respective branches.
Is Ivanti UWM on-premise affected?
Ivanti says CVE-2026-105813 affects UWM Neurons Hybrid only. UWM on-premise and Ivanti Neurons for App Control are not affected.
Did Ivanti report active exploitation?
Ivanti says it had no evidence of these vulnerabilities being exploited in the wild at disclosure.
