SB20261110342 - Missing Authentication for Critical Function in Ivanti Cloud Services Application

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110342

SB20261110342 - Missing Authentication for Critical Function in Ivanti Cloud Services Application

Published: November 10, 2026

Security Bulletin ID SB20261110342
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-121683)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to add and delete arbitrary trusted EPM Core certificate entries.

The vulnerability exists due to missing authentication in Ivanti Cloud Services Application when handling requests to manage trusted EPM Core certificate entries. A remote attacker can submit unauthorized certificate-management requests to add and delete arbitrary trusted EPM Core certificate entries.


Remediation

Install update from vendor's website.

References