Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5770 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ivanti EPM Service Spawning Shell or LOLBin (Post-Exploitation of CVE-2026-121653)

Detects Ivanti/LANDesk Endpoint Manager service processes spawning cmd, PowerShell, mshta, certutil, bitsadmin and similar LOLBins, the expected execution step after unauthenticated SQLi RCE on EPM Core (TL-2026-5770).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.001, T1059.003, T1190
• Data sources: Sysmon EventCode 1 (index=sysmon), Defender DeviceProcessEvents, Windows process_creation
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*landesk*" OR ParentImage="*ldms*" OR ParentImage="*ivanti*") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe" OR Image="*rundll32.exe" OR Image="*regsvr32.exe" OR Image="*curl.exe") | stats count as executions min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image | convert ctime(first_seen) ctime(last_seen) | sort - executions

Microsoft KQL

DeviceProcessEvents | where Timestamp > ago(24h) | where InitiatingProcessFolderPath contains "LANDesk" or InitiatingProcessFolderPath contains "Ivanti" or InitiatingProcessFileName contains "ldms" | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe", "regsvr32.exe", "curl.exe") | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine

Sigma

title: Ivanti EPM Service Spawns Shell or LOLBin
id: 2d9b7f14-8a6c-4e53-b1d0-6e3a9c5f7b02
status: experimental
description: Detects Ivanti or LANDesk Endpoint Manager processes spawning command interpreters or LOLBins, consistent with post-exploitation of CVE-2026-121653.
references:
  - https://www.ivanti.com/blog/november-2026-security-update
  - https://nvd.nist.gov/vuln/detail/CVE-2026-121653
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.003
  - attack.initial-access
  - attack.t1190
  - cve.2026.121653
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\LANDesk\'
      - '\Ivanti\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Ivanti agent patch or software-distribution tasks that run scripts
  - Administrator troubleshooting on the EPM Core server
level: high

Known false positives:

• Ivanti agent patch or software-distribution tasks that run scripts
• Administrator troubleshooting on the EPM Core server

Tuning notes: Restrict to EPM Core servers. Baseline legitimate child processes and exclude exact CommandLine values for scheduled Ivanti tasks. Prioritise PowerShell with -enc, certutil -urlcache and mshta.

• 🔒 Ivanti EPM Core Error-Based SQL Injection Probing (HTTP 500 Burst) · unlock with TL Creds
• 🔒 SQL Server Spawning Command Shell on Ivanti EPM Database (xp_cmdshell RCE Chain) · unlock with TL Creds
• 🔒 Trusted Root Certificate Store Modification on Ivanti EPM Core / CSA Hosts (CVE-2026-121683) · unlock with TL Creds
• 🔒 Unauthenticated Certificate Entry Modification Request to Ivanti CSA (CVE-2026-121683) · unlock with TL Creds
• 🔒 IIS Worker Process Spawning Shell or Recon Tool on EPM Server · unlock with TL Creds
• 🔒 Command-Line Import of Certificate into Trusted Root Store (certutil / PowerShell) · unlock with TL Creds
• 🔒 Ivanti EPM Core Unauthenticated SQL Injection Attempt (CVE-2026-121653) · unlock with TL Creds
• 🔒 Citrix XenServer Pool-Level Authentication from Non-Member Host (CVE-2026-102705) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5770.

Technical analysis

Ivanti states it has no evidence of in-the-wild exploitation.

On Tuesday 2026-11-10 Ivanti released its November 2026 security update covering 13 vulnerabilities across five products: Endpoint Manager (EPM), Cloud Services Application (CSA), Sentry, Endpoint Manager Mobile (EPMM) and User Workspace Manager (UWM). Ivanti states it has no evidence of these vulnerabilities being exploited in the wild and that they do not affect other Ivanti solutions.

CVE-2026-121653 (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-89) is a SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8. A remote, unauthenticated attacker can achieve remote code execution. EPM 2024 SU8 fixes it and also fixes a medium-severity cleartext transmission issue exploitable through a man-in-the-middle position.

CVE-2026-121683 (CVSS 3.1 9.4, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, CWE-306) is a missing-authentication flaw in Ivanti Cloud Services Application 5.0.8. A remote, unauthenticated attacker can add and delete arbitrary trusted EPM Core certificate entries. Ivanti says CSA deployments using a Dual NIC configuration cannot be exploited externally. The fix is CSA 5.0.8.1. Note: the NVD record lists 5.0.8 as 'unaffected' in its version field while its description names 5.0.8 as vulnerable; this contradiction should be checked against the vendor advisory.

CVE-2026-105425 is a high-severity remote code execution flaw in Ivanti Sentry that is also fixed in EPMM; its CVSS score and fixed versions were not retrievable from the sources reviewed. The Ivanti blog's advisory links also reference further Sentry IDs (CVE-2026-105669, CVE-2026-123179, CVE-2026-123181) and a UWM ID (CVE-2026-105813), but those were taken from link slugs only and were not verified against the advisories. Five medium-severity issues and one UWM medium issue are reported without IDs in the secondary coverage.

Citrix's XenServer update (CTX697316) fixes six security defects. CVE-2026-102705 is rated High and allows an attacker to infer the Pool Secret and compromise the host. The other five could allow privilege escalation or let administrators with any role terminate running tasks of other roles; their IDs and severities were not stated in the source. Additional XenServer updates mitigate several AMD CPU vulnerabilities that could allow a guest VM to compromise the host or infer active memory of another VM. Citrix CVSS scores and affected/fixed XenServer versions were not retrievable.

No public PoC, IOCs, malware, C2 infrastructure or threat-actor attribution is reported for any of these issues. The Ivanti advisory pages (hub.ivanti.com) and the Citrix support page are JavaScript-rendered and could not be read directly; CVSS and version details come from NVD and SecurityWeek.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1557 Adversary-in-the-Middle

defense-impairment

T1553 Subvert Trust Controls

Privilege Escalation

T1611 Escape to Host

Remediation

Patches

• Ivanti Endpoint Manager 2024 SU8 (CVE-2026-121653)
• Ivanti Cloud Services Application 5.0.8.1 (CVE-2026-121683)
• Apply Ivanti Sentry and EPMM updates per the November 2026 advisories (CVE-2026-105425); fixed versions not stated in reviewed sources
• Apply Citrix XenServer updates per CTX697316 (CVE-2026-102705)

Immediate actions

• Inventory internet-exposed Ivanti EPM, CSA, Sentry and EPMM instances and Citrix XenServer pools
• Restrict network access to EPM Core and CSA management interfaces until patched
• Review EPM Core trusted certificate entries for unexpected additions or deletions

Workarounds

• Use CSA Dual NIC configuration, which Ivanti states prevents external exploitation of CVE-2026-121683
• Limit exposure of XenServer management interfaces to trusted administrative networks

Longer-term hardening

• Place endpoint-management and hypervisor management planes behind segmentation and VPN/zero-trust access
• Monitor web and database logs on EPM Core for SQL injection patterns
• Subscribe to Ivanti and Citrix security advisories and CISA KEV for exploitation status changes

Affected and fixed versions

• Ivanti — Endpoint Manager (EPM)
  Vulnerable versions: Before 2024 SU8
  Fixed in: 2024 SU8
• Ivanti — Cloud Services Application (CSA)
  Vulnerable versions: 5.0.8
  Fixed in: 5.0.8.1
• Ivanti — Sentry and Endpoint Manager Mobile (EPMM)
  Vulnerable versions: Not stated in reviewed sources
  Fixed in: Not stated in reviewed sources
• Citrix — XenServer
  Vulnerable versions: Not stated in reviewed sources
  Fixed in: See CTX697316

Timeline

• 2026-11-10 NVD publishes CVE-2026-121683: missing authentication in Ivanti CSA 5.0.8 allowing unauthenticated add/delete of trusted EPM Core certificate entries (CVSS 9.4).
• 2026-11-10 NVD publishes CVE-2026-121653: SQL injection in Ivanti EPM Core before 2024 SU8 enabling unauthenticated RCE (CVSS 9.8).
• 2026-11-10 Citrix publishes XenServer security update CTX697316 fixing six defects including High-severity CVE-2026-102705 (Pool Secret inference leading to host compromise).
• 2026-11-10 Ivanti publishes its November 2026 security update fixing 13 vulnerabilities across EPM, CSA, Sentry, EPMM and UWM, stating it has no evidence of in-the-wild exploitation.
• 2026-11-11 NVD last-modified timestamp for CVE-2026-121653 updated.
• 2026-11-11 SecurityWeek reports the Citrix and Ivanti patches; no PoC, IOCs or attribution are reported.

Sources cited

• Ivanti Security Advisory: Endpoint Manager (EPM) November 2026 Ivanti · Advisory · 2026-11-10
• Ivanti Security Advisory: CSA CVE-2026-121683 Ivanti · Advisory · 2026-11-10
• Ivanti Security Advisory: Sentry CVE-2026-105425 and related CVEs Ivanti · Advisory · 2026-11-10
• Ivanti Security Advisory: EPMM November 2026 Multiple CVEs Ivanti · Advisory · 2026-11-10
• NVD: CVE-2026-121653 NVD (NIST) · Advisory · 2026-11-10
• NVD: CVE-2026-121683 NVD (NIST) · Advisory · 2026-11-10
• Ivanti November 2026 Security Update Ivanti · Vendor report · 2026-11-10
• Citrix XenServer Security Update for Multiple Issues (CTX697316) support.citrix.com · Vendor report · 2026-11-10
• Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities (SecurityWeek) SecurityWeek · News · 2026-11-11

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)
• Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)

Further reading

• Ivanti EPMM RCE: CVE-2026-1281, CVE-2026-1340