# Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches

> Ivanti patched a critical unauthenticated SQL injection in Endpoint Manager (EPM) leading to RCE (CVSS 9.8) and a critical missing-authentication flaw in Cloud Services Application (CSA) (CVSS 9.4), plus a high-severity RCE in Sentry (also fixed in EPMM). Citrix patched six XenServer flaws, including a high-severity issue allowing inference of the Pool Secret and host compromise. Ivanti states it has no evidence of in-the-wild exploitation.

- **Published:** 2026-11-11T13:47:36Z
- **Last reviewed:** 2026-11-11T13:47:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5770
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5770.png
- **ID:** TL-2026-5770
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-121653, CVE-2026-121683, CVE-2026-105425, CVE-2026-102705, CVE-2026-105669, CVE-2026-123179, CVE-2026-123181

## Description

On Tuesday 2026-11-10 Ivanti released its November 2026 security update covering 13 vulnerabilities across five products: Endpoint Manager (EPM), Cloud Services Application (CSA), Sentry, Endpoint Manager Mobile (EPMM) and User Workspace Manager (UWM). Ivanti states it has no evidence of these vulnerabilities being exploited in the wild and that they do not affect other Ivanti solutions.

CVE-2026-121653 (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-89) is a SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8. A remote, unauthenticated attacker can achieve remote code execution. EPM 2024 SU8 fixes it and also fixes a medium-severity cleartext transmission issue exploitable through a man-in-the-middle position.

CVE-2026-121683 (CVSS 3.1 9.4, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, CWE-306) is a missing-authentication flaw in Ivanti Cloud Services Application 5.0.8. A remote, unauthenticated attacker can add and delete arbitrary trusted EPM Core certificate entries. Ivanti says CSA deployments using a Dual NIC configuration cannot be exploited externally. The fix is CSA 5.0.8.1. Note: the NVD record lists 5.0.8 as 'unaffected' in its version field while its description names 5.0.8 as vulnerable; this contradiction should be checked against the vendor advisory.

CVE-2026-105425 is a high-severity remote code execution flaw in Ivanti Sentry that is also fixed in EPMM; its CVSS score and fixed versions were not retrievable from the sources reviewed. The Ivanti blog's advisory links also reference further Sentry IDs (CVE-2026-105669, CVE-2026-123179, CVE-2026-123181) and a UWM ID (CVE-2026-105813), but those were taken from link slugs only and were not verified against the advisories. Five medium-severity issues and one UWM medium issue are reported without IDs in the secondary coverage.

Citrix's XenServer update (CTX697316) fixes six security defects. CVE-2026-102705 is rated High and allows an attacker to infer the Pool Secret and compromise the host. The other five could allow privilege escalation or let administrators with any role terminate running tasks of other roles; their IDs and severities were not stated in the source. Additional XenServer updates mitigate several AMD CPU vulnerabilities that could allow a guest VM to compromise the host or infer active memory of another VM. Citrix CVSS scores and affected/fixed XenServer versions were not retrievable.

No public PoC, IOCs, malware, C2 infrastructure or threat-actor attribution is reported for any of these issues. The Ivanti advisory pages (hub.ivanti.com) and the Citrix support page are JavaScript-rendered and could not be read directly; CVSS and version details come from NVD and SecurityWeek.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1553 Subvert Trust Controls
- T1212 Exploitation for Credential Access
- T1557 Adversary-in-the-Middle
- T1611 Escape to Host

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ivanti EPM Service Spawning Shell or LOLBin (Post-Exploitation of CVE-2026-121653)** (`TL-2026-5770-SPL-002`)

Detects Ivanti/LANDesk Endpoint Manager service processes spawning cmd, PowerShell, mshta, certutil, bitsadmin and similar LOLBins, the expected execution step after unauthenticated SQLi RCE on EPM Core (TL-2026-5770).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.001, T1059.003, T1190
- **Data sources:** Sysmon EventCode 1 (index=sysmon), Defender DeviceProcessEvents, Windows process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*landesk*" OR ParentImage="*ldms*" OR ParentImage="*ivanti*") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe" OR Image="*rundll32.exe" OR Image="*regsvr32.exe" OR Image="*curl.exe") | stats count as executions min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image | convert ctime(first_seen) ctime(last_seen) | sort - executions
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | where InitiatingProcessFolderPath contains "LANDesk" or InitiatingProcessFolderPath contains "Ivanti" or InitiatingProcessFileName contains "ldms" | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe", "regsvr32.exe", "curl.exe") | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Ivanti EPM Service Spawns Shell or LOLBin
id: 2d9b7f14-8a6c-4e53-b1d0-6e3a9c5f7b02
status: experimental
description: Detects Ivanti or LANDesk Endpoint Manager processes spawning command interpreters or LOLBins, consistent with post-exploitation of CVE-2026-121653.
references:
  - https://www.ivanti.com/blog/november-2026-security-update
  - https://nvd.nist.gov/vuln/detail/CVE-2026-121653
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.003
  - attack.initial-access
  - attack.t1190
  - cve.2026.121653
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\LANDesk\'
      - '\Ivanti\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Ivanti agent patch or software-distribution tasks that run scripts
  - Administrator troubleshooting on the EPM Core server
level: high

```

**Known false positives:**

- Ivanti agent patch or software-distribution tasks that run scripts
- Administrator troubleshooting on the EPM Core server

**Tuning notes:** Restrict to EPM Core servers. Baseline legitimate child processes and exclude exact CommandLine values for scheduled Ivanti tasks. Prioritise PowerShell with -enc, certutil -urlcache and mshta.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ivanti EPM Core Error-Based SQL Injection Probing (HTTP 500 Burst) (locked: unlock with TL Creds)
- SQL Server Spawning Command Shell on Ivanti EPM Database (xp_cmdshell RCE Chain) (locked: unlock with TL Creds)
- Trusted Root Certificate Store Modification on Ivanti EPM Core / CSA Hosts (CVE-2026-121683) (locked: unlock with TL Creds)
- Unauthenticated Certificate Entry Modification Request to Ivanti CSA (CVE-2026-121683) (locked: unlock with TL Creds)
- IIS Worker Process Spawning Shell or Recon Tool on EPM Server (locked: unlock with TL Creds)
- Command-Line Import of Certificate into Trusted Root Store (certutil / PowerShell) (locked: unlock with TL Creds)
- Ivanti EPM Core Unauthenticated SQL Injection Attempt (CVE-2026-121653) (locked: unlock with TL Creds)
- Citrix XenServer Pool-Level Authentication from Non-Member Host (CVE-2026-102705) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities (SecurityWeek)](https://www.securityweek.com/citrix-ivanti-patch-critical-and-high-severity-vulnerabilities/)
- [Ivanti November 2026 Security Update](https://www.ivanti.com/blog/november-2026-security-update)
- [Ivanti Security Advisory: Endpoint Manager (EPM) November 2026](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026)
- [Ivanti Security Advisory: CSA CVE-2026-121683](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-CVE-2026-121683)
- [Ivanti Security Advisory: Sentry CVE-2026-105425 and related CVEs](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181)
- [Ivanti Security Advisory: EPMM November 2026 Multiple CVEs](https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs)
- [NVD: CVE-2026-121653](https://nvd.nist.gov/vuln/detail/CVE-2026-121653)
- [NVD: CVE-2026-121683](https://nvd.nist.gov/vuln/detail/CVE-2026-121683)
- [Citrix XenServer Security Update for Multiple Issues (CTX697316)](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697316&articleURL=XenServer_Security_Update_for_Multiple_Issues)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5770