Ivanti and Zoom patch critical flaws as Citrix and Asus ship security fixes

Ivanti's two critical bugs are CVE-2026-121653, an unauthenticated SQL injection in Endpoint Manager rated CVSS 9.8, and CVE-2026-121683, a missing-authentication flaw in Cloud Services Application rated 9.4 [1] [2] .

Zoom's CVE-2026-108186 (CVSS 9.6) lets a remote, unauthenticated attacker escalate privileges in Zoom Workplace for Windows; version 7.1.8 and later fix it [3] [4] .

Ivanti, Zoom and Citrix reported no exploitation, and Ivanti said advanced LLMs in its security testing found some of the flaws it disclosed [1] [2] [3] .

Ivanti and Zoom patched critical vulnerabilities on Nov. 10, while Citrix and Asus shipped fixes for high-severity bugs, adding to a Patch Tuesday week that has already produced hundreds of fixes from Microsoft, Fortinet, SAP, Adobe, Intel and AMD [1] [3] . None of the vendors said any of the new flaws had been exploited [1] [2] [3] .

Ivanti disclosed 13 vulnerabilities across five products [1] . The most severe, CVE-2026-121653 (CVSS 9.8), is a SQL injection in Endpoint Manager (EPM) that can lead to remote code execution without authentication; EPM 2024 SU8 fixes it, along with a medium-severity cleartext transmission bug [1] . CVE-2026-121683 (CVSS 9.4) is a missing-authentication flaw in Cloud Services Application that lets a remote, unauthenticated attacker "add and delete arbitrary trusted EPM Core certificate entries"; version 5.0.8.1 patches it, and deployments with a dual-NIC configuration cannot be exploited externally [1] . Ivanti also fixed four Sentry flaws, including a high-severity remote code execution bug (CVE-2026-105425) that also affects Endpoint Manager Mobile, plus five medium-severity EPMM issues and one in User Workspace Manager [1] .

Zoom, Citrix and Asus

Ivanti said it has built "multiple advanced LLM models" into its product security work and that they have found vulnerabilities traditional tools missed, "including some that we are disclosing today"; it expects disclosures to rise as a result [2] . Fortinet made a similar point the same day when it shipped nearly 100 fixes ( MLQ.ai coverage ).

Zoom's critical bug, CVE-2026-108186 (CVSS 9.6), is an improper input validation flaw in Zoom Workplace for Windows that allows unauthenticated privilege escalation; a second flaw, CVE-2026-108187 (CVSS 8.1), is an origin validation error that can also let remote, unauthenticated attackers elevate privileges [3] [4] . Workplace for Windows 7.1.8 and later contain both fixes [3] .

Citrix rated its XenServer bulletin high severity. CVE-2026-102705 may let an unauthenticated attacker on the management network "eventually infer the Pool Secret and so compromise the host," and five further bugs let authenticated administrators escalate to the Pool Administrator role or kill other roles' running tasks [5] . The updates for XenServer 8.4 and 9 also carry AMD microcode that mitigates CPU flaws allowing a guest VM to compromise the host or read memory from another VM, and Citrix pointed customers to instructions for rotating the Pool Secret [5] . Asus published an advisory for four high- and medium-severity flaws in some router firmware that could let attackers run commands as root or crash the device by overwriting memory [3] .

Microsoft's own November release fixed 1,093 flaws, including an exploited Outlook zero-day ( MLQ.ai coverage ).