Introduction
According to the NVD description for CVE-2026-121683, an attacker with network access to an Ivanti Cloud Services Application instance can add or remove the trusted EPM Core certificate entries on that appliance without authenticating at all. The CSA brokers communication between the Ivanti console and managed devices, so unauthenticated changes to its certificate trust entries affect one of the more security-sensitive functions the appliance performs.
The Ivanti Cloud Services Appliance (named "Cloud Services Application" in the NVD record) provides secure Internet communication between an Ivanti console and managed devices, including devices that sit behind firewalls or connect through a proxy. Ivanti says the company was created in 2017 through the merger of LANDesk and HEAT Software, and it describes its offering as IT solutions. The sources we reviewed do not provide independently supported market share or deployment figures for the CSA. Its relevance comes from where it sits in endpoint management deployments and from the fact that earlier CSA vulnerabilities have been exploited.
Technical information
Root cause
The CNA classifies this issue as CWE-306, Missing Authentication for Critical Function, and assigned a CVSS score of 9.4 (Critical). NVD has not published its own score assessment. The critical function here is the management of trusted EPM Core certificate entries. Per the NVD description, a remote unauthenticated attacker can add and delete arbitrary entries in that trust list. The appliance exposes an operation that changes its trust configuration without first verifying who is making the request.
Severity characteristics
The CVSS properties published with the record are:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Integrity impact: High
- Availability impact: High
- Confidentiality impact: Low
These properties describe severity. They are not evidence that exploitation has occurred.
Why certificate handling matters on the CSA
Ivanti's CSA documentation states that managed devices need valid digital certificates to connect through the CSA, and that device certificates can be approved or blocked. Certificate trust is therefore central to how the appliance decides which parties may communicate through it. That context explains why an unauthenticated ability to change EPM Core certificate entries is rated as severe. The documentation does not explain the precise downstream consequence of modifying EPM Core certificate entries in this specific vulnerability, and we do not speculate beyond it here.
Attack flow
Based only on the published description, the attack sequence looks like this:
- The attacker reaches the affected CSA function over the network. The specific interface or endpoint has not been disclosed.
- The attacker sends a request to the certificate management function without supplying any credentials. Because authentication is missing, the appliance does not reject the request.
- The attacker either adds an arbitrary entry to the trusted EPM Core certificate list or deletes existing entries.
- The resulting changes map to the high integrity impact (unauthorized trust entries) and high availability impact (removal of entries) in the CVSS rating.
What is not known
The available sources do not disclose a vulnerable endpoint, request format, exploit code, or a detailed exploitation procedure. We cannot substantiate a more specific exploitation method at this time.
Affected systems and versions
- Product: Ivanti Cloud Services Appliance (Cloud Services Application in the NVD record)
- Version named in the NVD description: 5.0.8
The NVD record contradicts itself. Its description names version 5.0.8 as affected, while the affected-products table in the same record labels 5.0.8 as unaffected. The record does not resolve this conflict, so the exposure status of 5.0.8 is unconfirmed. The sources we reviewed also do not establish a fixed version or a vulnerability-specific workaround, and the retrieved Ivanti advisory page did not provide readable details.
To confirm versions, we recommend not relying on the NVD description or the product table alone. Get clarification from Ivanti through the linked advisory or its support channel before concluding that an installation is affected or safe.
Two related statements could be misread as remediation guidance. Ivanti's lifecycle page identifies CSA 5.0 as the current supported version. Separately, a 2024 CISA notice concerning CVE-2024-8190 relayed Ivanti's instruction for affected CSA 4.6 users to upgrade to CSA 5.0. Neither statement identifies CSA 5.0 as a fix for CVE-2026-121683, and that older upgrade guidance should not be treated as remediation for this CVE.
Vendor security history
The CSA product line has a documented history of exploited vulnerabilities. That history is useful context, but it must be kept separate from this new issue:
- CVE-2024-8190 (CSA 4.6): In September 2024, CISA reported limited exploitation and noted that Ivanti had released a security update.
- CVE-2024-8963 (CSA 4.6): Ivanti's advisory said a limited number of customers had been exploited and described the risk when this issue was combined with CVE-2024-8190.
- CISA also published an advisory titled "Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications".
These incidents show that prior CSA vulnerabilities were exploited. They do not demonstrate exploitation of CVE-2026-121683.
The current exploitation status of CVE-2026-121683 is unknown. The retrieved CISA Known Exploited Vulnerabilities feed is dated November 9, 2026, while NVD lists this CVE as published on November 10, 2026, so its absence from that feed does not establish that it has not been exploited since disclosure. The NVD record does not state whether exploitation is occurring, and we found no threat actor attribution or CVE-specific exploitation report.
References
- NVD entry for CVE-2026-121683
- CVE.org record for CVE-2026-121683
- Ivanti Security Advisory for CSA, CVE-2026-121683
- CISA: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
- CISA: Ivanti Releases Security Update for Cloud Services Appliance
- Ivanti Security Advisory for CSA 4.6 (CVE-2024-8963)
- Ivanti Endpoint Manager, Endpoint Manager Security Suite, and CSA End Of Life (EOL) information
- Ivanti documentation: Configuring the Ivanti Cloud Services Appliance
- CISA Known Exploited Vulnerabilities feed (JSON)
- About Ivanti
