IVANTI CLOUD SERVICES APPLICATION · CVE-2026-121683 · Vendor
NO FIX YET
Ivanti Cloud Services Application 5.0.8 lacks authentication on a function that adds and deletes trusted EPM Core certificate entries. A remote attacker with no account could add their own trusted certificate or remove existing ones.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running Ivanti Cloud Services Application version 5.0.8 with EPM Core trusted certificate handling. The sources do not state which deployments are exposed beyond that version.
Who cares cloud-services-application, epm-core, ivanti
5.0.8No fix yet, per the sources.
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.