Back Securityweek Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Citrix and Ivanti on Tuesday announced patches for 19 vulnerabilities in their products, including multiple critical- and high-severity flaws.
Ivanti fixed 13 vulnerabilities across five products, including two critical-severity defects in Cloud Services Application (CSA) and Endpoint Manager (EPM).
Tracked as CVE-2026-121683 (CVSS score of 9.4), the CSA flaw is described as a missing authentication issue that could allow remote, unauthenticated attackers to “add and delete arbitrary trusted EPM Core certificate entries”.
CSA version 5.0.8.1 patches the bug. Deployments running with a Dual NIC configuration cannot be exploited externally, Ivanti notes.
The critical EPM issue, tracked as CVE-2026-121653 (CVSS score of 9.8), is an SQL injection bug that could lead to remote code execution (RCE) without authentication.
It was resolved in EPM version 2024 SU8, which also addresses a medium-severity cleartext transmission of sensitive information exploitable via MitM attacks.
Ivanti released patches for four vulnerabilities in Sentry, including a high-severity remote code execution (RCE) flaw. Tracked as CVE-2026-105425, the bug was also fixed in Endpoint Manager Mobile (EPMM), along with five medium-severity issues.
On Tuesday, the company also addressed a medium-severity defect in User Workspace Manager (UWM). Ivanti says it has no evidence of any of these vulnerabilities being exploited in the wild.
Citrix rolled out fixes for six security defects in XenServer, including CVE-2026-102705, a high-severity bug that could allow attackers to infer the Pool Secret and compromise the host.
The remaining five issues could lead to privilege escalation or could allow administrators with any role to terminate the running tasks of other roles.
Additionally, Citrix released XenServer updates that mitigate several AMD CPU vulnerabilities that could allow guest VMs to compromise the host or infer the active memory content of another VM.
Related: Fortinet Patches Nearly 100 Vulnerabilities
Related: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Related: Adobe Patches 110 Vulnerabilities Across 9 Products
Related: SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
WhiteMatter Raises $20 Million in Series A Funding
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
Plex2Shell Exploited Against QNAP NAS Users
Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online
Critical Xen Orchestra Flaws Exploited in Attacks
Asus, Zoom Release Security Patches
Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices
Fortinet Patches Nearly 100 Vulnerabilities
Bay Raises $50 Million to Control What Enterprise AI Agents Can Do
Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks
ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
