{"id":4208,"date":"2026-11-12T07:03:26","date_gmt":"2026-11-12T15:03:26","guid":{"rendered":"https:\/\/cyber.mag212.com\/ivanti-epm-cve-2026-121653-csa-cve-2026-121683-citrix-xenserver-november-2026-patches\/"},"modified":"2026-11-12T07:03:26","modified_gmt":"2026-11-12T15:03:26","slug":"ivanti-epm-cve-2026-121653-csa-cve-2026-121683-citrix-xenserver-november-2026-patches","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/ivanti-epm-cve-2026-121653-csa-cve-2026-121683-citrix-xenserver-november-2026-patches\/","title":{"rendered":"Ivanti et Citrix publient des correctifs critiques pour les plateformes de gestion\u00a0: EPM 2024 SU8, CSA 5.0.8.1 et XenServer"},"content":{"rendered":"\n

Ivanti and Citrix have released fixes for nineteen vulnerabilities across their management products, and two of Ivanti\u2019s are critical. An Endpoint Manager SQL injection (CVE-2026-121653, 9.8) can lead to unauthenticated remote code execution, and a missing-authentication flaw in Cloud Services Application (CVE-2026-121683, 9.4) lets an attacker add or delete trusted EPM Core certificates. Citrix\u2019s XenServer update fixes a flaw that could let an attacker infer the pool secret and take over the host. Ivanti says none of its flaws is known to be exploited.<\/p>\n\n\n\n

Total<\/strong><\/td>19 flaws: 13 Ivanti, 6 Citrix<\/td><\/tr>
Top fix<\/strong><\/td>EPM 2024 SU8 (CVE-2026-121653)<\/td><\/tr>
CSA<\/strong><\/td>5.0.8.1 (CVE-2026-121683)<\/td><\/tr>
XenServer<\/strong><\/td>CTX697316 (CVE-2026-102705)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened, who is affected and how it works<\/h2>\n\n\n\n

[Reported]<\/strong> Ivanti fixed an Endpoint Manager SQL injection that can lead to unauthenticated remote code execution<\/strong> (CVE-2026-121653, 9.8; EPM 2024 SU8) and a Cloud Services Application missing-authentication flaw<\/strong> that lets an attacker add or delete trusted EPM Core certificate entries (CVE-2026-121683, 9.4; CSA 5.0.8.1). CSA with a dual-NIC setup isn’t externally exploitable. A high-severity Sentry RCE (CVE-2026-105425) is also fixed. [Confirmed]<\/strong> Ivanti’s own update post says it has no evidence of these flaws being exploited and names four Sentry CVEs (CVE-2026-105425, -105669, -123179, -123181), a User Workspace Manager flaw (CVE-2026-105813) and CVE-2026-121683 for CSA, plus EPM and EPMM advisories. (Ivanti<\/a>) [Reported]<\/strong> Citrix’s XenServer update fixes CVE-2026-102705, which could let an attacker infer the pool secret and compromise the host, plus five privilege-escalation and task-termination issues and mitigations for AMD guest-to-host flaws; Citrix doesn’t state exploitation. (SecurityWeek<\/a>) MAG212 opened Ivanti’s summary post but not the per-product advisories or Citrix’s bulletin, so the EPM score and fixed builds come from SecurityWeek. (Citrix<\/a>)<\/p>\n\n\n\n

\"Table
Figure 7 \u00b7 Ivanti and Citrix: what to patch first.<\/strong> The four flaws that matter most from 19 fixed this week. None is reported exploited. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

What to look for, then fix (in order)<\/h2>\n\n\n\n
    \n
  1. EPM core servers first:<\/strong> upgrade to 2024 SU8. [MAG212 analysis]<\/strong> Ivanti flaws have a history of fast weaponisation once patches are diffed; don’t wait for a KEV entry.<\/li>\n\n\n
  2. CSA:<\/strong> 5.0.8.1; check whether yours runs single-NIC.<\/li>\n\n\n
  3. [MAG212 analysis]<\/strong> After patching<\/strong>, review EPM’s trusted certificate list for entries you didn’t add.<\/li>\n\n\n
  4. XenServer:<\/strong> apply CTX697316; keep the management network isolated (the same lesson as this week’s Xen Orchestra attacks).<\/li>\n\n<\/ol>\n\n\n\n

    Verify recovery:<\/strong> versions confirmed; EPM certificate list reviewed. Prevention<\/strong> [MAG212 analysis]<\/strong>: endpoint-management servers can push code to every machine, like the ScreenConnect consoles in story 1. Give them the same isolation as a domain controller.<\/p>\n\n\n\n

    Why management platforms keep making the news<\/h2>\n\n\n\n

    [MAG212 analysis]<\/strong> Endpoint managers, mobile-device managers and remote-support consoles share one property attackers love: by design, they can run code on every machine they manage. A single flaw in the server therefore becomes a flaw in the whole estate, and the server itself is often exposed to the internet so that laptops can check in from home.<\/p>\n\n\n\n

    [MAG212 analysis]<\/strong> The practical response is the same regardless of vendor. Keep the management server off the open internet where the product allows it, or put it behind a VPN or an identity-aware proxy; give its administrative accounts phishing-resistant multi-factor authentication; log and alert on new administrators, new certificates and mass software deployments; and treat its database and backups as tier-zero assets, like a domain controller.<\/p>\n\n\n\n

    [MAG212 analysis]<\/strong> For the CSA flaw specifically, check how your appliance is cabled. Ivanti says a dual-NIC setup is not externally exploitable, so a single-NIC CSA facing the internet should move to the front of the queue.<\/p>\n\n\n\n

    Why it matters<\/h2>\n\n\n\n

    Endpoint-management and virtualisation platforms can push code to every machine an organisation owns, which is why this week\u2019s ScreenConnect campaign was so damaging. Ivanti products in particular have a history of being weaponised soon after patches are published and analysed, often by state-backed actors, and schools, councils and MSPs run EPM widely.<\/p>\n\n\n\n

    The bottom line<\/h2>\n\n\n\n

    Upgrade EPM core servers to 2024 SU8 first, move CSA to 5.0.8.1, apply Citrix CTX697316 to XenServer pools, and afterwards review EPM\u2019s trusted certificate list for entries nobody added.<\/p>\n\n\n\n

    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n

    \n\n\n\n

    This story is part of MAG212 CYBER Daily, 12 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

    Ivanti\u2019s November update fixes a 9.8 Endpoint Manager SQL injection that can lead to unauthenticated RCE and a 9.4 missing-authentication flaw in Cloud Services Application; Citrix fixes a XenServer pool-secret flaw. None is reported exploited. What to patch first and what to review afterwards.<\/p>","protected":false},"author":1,"featured_media":4197,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,14],"tags":[335,337,236,107,336],"class_list":["post-4208","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-vulnerabilities","tag-citrix","tag-endpoint-management","tag-ivanti","tag-patch-management","tag-xenserver"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4208"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4208\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4197"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}