CompTIAAvailable
CS0-003
Citrix, Ivanti Patch Critical and High-Severity Flaws
Citrix and Ivanti patched 19 vulnerabilities, including critical flaws in Ivanti CSA and Endpoint Manager. Here is what to update and how to check your exposure.
Short answer: Citrix and Ivanti patched 19 vulnerabilities. The worst are Ivanti CVE-2026-121653 (CVSS 9.8, SQL injection leading to unauthenticated RCE in EPM) and CVE-2026-121683 (CVSS 9.4, missing authentication in CSA). Ivanti says it has no evidence of exploitation in the wild, so patch EPM and CSA first.
Citrix and Ivanti patched 19 vulnerabilities, including two critical Ivanti flaws that attackers could use without logging in. Update Ivanti Endpoint Manager (EPM) and Cloud Services Application (CSA) first, then Sentry, EPMM and Citrix XenServer.
SecurityWeek reported that Ivanti has no evidence of any of its bugs being exploited in the wild. That gives you a window, but not a long one.
What happened
Ivanti fixed 13 vulnerabilities across five products. Two are critical, in CSA and EPM. Citrix fixed six security defects in XenServer and also shipped updates for several AMD CPU vulnerabilities.
The possible outcomes include tampering with certificate entries, remote code execution (RCE) and compromise of a virtualization host.
Who is affected and which versions fix it
The table lists the fixes where the report names a version.
Product | Flaw | Severity | Fixed in |
|---|---|---|---|
Ivanti CSA |
| Critical, CVSS 9.4 |
|
Ivanti EPM |
| Critical, CVSS 9.8 |
|
Ivanti Sentry and EPMM |
| High | Vendor update released |
Citrix XenServer |
| High | Vendor update released |
The CSA bug lets remote, unauthenticated attackers "add and delete arbitrary trusted EPM Core certificate entries". Ivanti notes that CSA deployments running a Dual NIC configuration cannot be exploited externally.
The EPM update also fixes a medium-severity cleartext transmission issue that attackers could exploit through MitM attacks.
Other Ivanti fixes:
Sentry received patches for four vulnerabilities, including the high-severity RCE.
EPMM received the same RCE fix plus five medium-severity fixes.
User Workspace Manager (UWM) received a fix for one medium-severity defect.
Other Citrix fixes:
Five XenServer issues could lead to privilege escalation.
One of them lets administrators with any role terminate running tasks of other roles.
The AMD updates address bugs that could let guest VMs compromise the host or infer another VM's active memory content.
How serious it is and whether it is exploited
The EPM flaw is the most serious. A 9.8 score, no authentication and a path to RCE is the combination attackers like most.
The CSA flaw scores 9.4 and affects trust decisions, because forged certificate entries can undermine what EPM Core trusts. Ivanti says it has no evidence of exploitation in the wild for any of these bugs.
The XenServer Pool Secret issue matters because one compromised host can put a whole pool at risk. For Citrix exploitation status, check the Citrix security bulletin, since the report only covers Ivanti's statement.
Patch details are public once advisories ship, and that is when exploit development often starts. See how fast it went in our write-up of the N-central zero-day exploited hours after PoC release.
What to do now
Work in this order. Each step takes a short time if you have an inventory.
Update EPM to
2024 SU8.Update CSA to
5.0.8.1.Apply the Sentry and EPMM updates from Ivanti's advisory.
Update XenServer hosts and install the AMD-related updates.
Patch UWM when you can.
Find your exposure
Start with what is reachable from the internet. Run this against your own public range only:
nmap -p 443 --open -Pn <your-public-range>Then list Ivanti software installed on a Windows server and its version:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match "Ivanti|Endpoint Manager" | Select-Object DisplayName, DisplayVersionOn XenServer, list the hosts and read each software version:
xe host-list params=uuid,name-label
xe host-param-get uuid=<host-uuid> param-name=software-versionCompare the output with the fixed versions in the table above and the vendor advisories.
Reduce risk if you cannot patch today
Check whether your CSA runs a Dual NIC configuration. Ivanti says those deployments cannot be exploited externally.
Remove management interfaces from the public internet.
Review EPM Core certificate entries for ones you do not recognize.
Restrict XenServer administrator roles to the people who need them.
Worked example: deciding the order
Say you run EPM on an internal server, CSA on an internet-facing host and two XenServer pools.
Asset | Why | Priority |
|---|---|---|
Internet-facing CSA | Unauthenticated, reachable, 9.4 | First, unless Dual NIC is set |
EPM server | Unauthenticated RCE, 9.8 | Same day |
XenServer pools | Pool Secret and privilege issues | Next maintenance window, pulled forward |
UWM | Medium severity | Normal cycle |
If your CSA already uses a Dual NIC setup, EPM moves to the top of the list.
What IT and security learners can take from this
This story shows three common exam topics in real life: unauthenticated access, injection flaws and hypervisor trust boundaries. Practice reading a CVSS score together with the exposure facts, such as whether authentication is needed and whether a bug is reachable from outside. Our Citrix-adjacent Xen Orchestra article covers the virtualization side. If you want a path for this kind of work, the CompTIA SecurityX CAS-005 voucher costs $44.99 less than... see the listing for current price.
If you are planning your next exam, browse our cybersecurity certifications.
Sources
Questions about this topic
Which of these bugs should I patch first?
Start with Ivanti EPM `CVE-2026-121653` (CVSS 9.8) and Ivanti CSA `CVE-2026-121683` (CVSS 9.4). Both are critical and exploitable without authentication. CSA drops lower if it runs a Dual NIC configuration, since Ivanti says those cannot be exploited externally.
Does a Dual NIC setup make CSA safe?
Ivanti says CSA deployments running with a Dual NIC configuration cannot be exploited externally. That reduces exposure but does not remove the bug. Update to CSA `5.0.8.1` anyway.
What could an attacker do with the XenServer Pool Secret bug?
Per the report, `CVE-2026-102705` could let attackers infer the Pool Secret and compromise the host. It is rated high severity. Apply the XenServer updates from Citrix.
Do the AMD CPU fixes in XenServer matter if I trust my guest VMs?
The updates address flaws that could let guest VMs compromise the host or infer the active memory content of another VM. If tenants or teams share hosts, install them. Even on trusted setups, the updates ship alongside the other fixes.
How can I tell if someone already abused the CSA flaw?
The bug lets attackers add and delete trusted EPM Core certificate entries. Review those entries for ones you did not create and check your Ivanti logs around internet-facing CSA hosts. Ivanti says it has no evidence of exploitation in the wild.
