CVE-2026-121683

Summary

The Ivanti Cloud Services Application v5.0.8 lacks authentication for a critical certificate management endpoint, allowing unauthenticated remote attackers to add or delete trusted EPM Core certificates. This enables attackers to impersonate legitimate services or bypass certificate-based trust controls.

Exploitability

Exploitation requires no authentication or user interaction and is trivial for any remote attacker with network access to the affected service.

Blast radius

Successful exploitation could allow an attacker to inject malicious trusted certificates, leading to man-in-the-middle attacks, unauthorized system access, or compromise of downstream EPM Core communications.

Detection

Defenders should monitor for unauthenticated HTTPS requests to certificate management endpoints (e.g., /api/certificates) that result in POST or DELETE operations; such activity without valid session tokens or API keys is highly suspicious. Review access logs for requests originating from non-trusted IP ranges targeting privileged certificate endpoints.

Prioritized remediation

Upgrade to Ivanti Cloud Services Application version 5.0.9 or later, which addresses this missing authentication flaw per vendor advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.