Missing Authentication for Critical Function in Ivanti Cloud Services Application - CVE-2026-121683
Published: November 10, 2026
Vulnerability identifier: #VU164593
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121683
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to add and delete arbitrary trusted EPM Core certificate entries.
The vulnerability exists due to missing authentication in Ivanti Cloud Services Application when handling requests to manage trusted EPM Core certificate entries. A remote attacker can submit unauthorized certificate-management requests to add and delete arbitrary trusted EPM Core certificate entries.
Affected software
Ivanti Cloud Services Application
How to mitigate CVE-2026-121683
Install security update from vendor's website.
Ivanti Cloud Services Application - update to 5.0.8.1