Authentication Bypass Vulnerability in Ivanti Cloud Services Application
CVE-2026-121683

9.4CRITICAL

Key Information:

Vendor

Ivanti
Status
Cloud Services Application
Vendor
CVE Published:
10 November 2026

What is CVE-2026-121683?

The Ivanti Cloud Services Application version 5.0.8 is affected by a vulnerability that allows a remote unauthenticated attacker to manipulate trusted EPM Core certificate entries without any authentication. This could lead to unauthorized addition and deletion of certificates, compromising the integrity and security of the cloud services environment.

Affected Version(s)

Cloud Services Application 5.0.8

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti...

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.