CVE-2026-121683: Critical severity vulnerability

Published Nov 10, 2026

Updated

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without authentication or user interaction. The attack complexity is low.

What can an attacker change if exploitation succeeds?

An attacker can add arbitrary trusted EPM Core certificate entries and delete existing trusted EPM Core certificate entries. This can affect the integrity and availability of the certificate trust configuration.

Which deployment is identified as affected?

The affected product is Ivanti Cloud Services Application version 5.0.8. The provided information does not identify other affected versions or configurations.

CVE-2026-121683: Critical severity vulnerability

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker change if exploitation succeeds?

Which deployment is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker change if exploitation succeeds?

Which deployment is identified as affected?