Citrix and Ivanti have released critical patches for a total of 19 vulnerabilities in their products, including multiple high-severity flaws that could allow attackers to remotely execute code or exploit sensitive information. The patches address weaknesses across several product lines, including Citrix’s XenServer and Ivanti’s Endpoint Manager, Cloud Services Application, and Sentry.
The most concerning vulnerability was found in Ivanti’s Cloud Services Application (CSA), which contains a critical flaw tracked as CVE-2026-121683 (CVSS score of 9.4). This bug allows remote, unauthenticated attackers to “add and delete arbitrary trusted EPM Core certificate entries,” essentially granting them access to sensitive information without needing credentials. Ivanti’s patch for CSA version 5.0.8.1 fixes the issue, but it notes that deployments running with a Dual NIC configuration cannot be exploited externally.
Citrix has also rolled out fixes for six security defects in XenServer, including CVE-2026-102705, a high-severity bug that could allow attackers to infer the Pool Secret and compromise the host. The remaining five issues could lead to privilege escalation or allow administrators with any role to terminate the running tasks of other roles.
Ivanti has addressed several vulnerabilities across its product lines, including four in Sentry, where a high-severity remote code execution (RCE) flaw was fixed. Additionally, Ivanti patched five medium-severity issues in Endpoint Manager and User Workspace Manager (UWM).
It’s worth noting that while the patches address serious security flaws, Ivanti claims it has no evidence of any of these vulnerabilities being exploited in the wild. However, this may not necessarily be a reason for complacency, as attackers often take their time before exploiting known weaknesses.
Citrix and Ivanti’s patch releases come at a time when many organizations are already struggling to keep up with the rapid pace of vulnerability disclosures. With so many security flaws being discovered and patched every day, it can be challenging for IT teams to prioritize which fixes are most critical. In this case, we recommend that users review their product versions, apply any available patches, and ensure they have adequate monitoring in place to detect any potential exploitation attempts.
In particular, the high-severity bugs found in CSA and XenServer highlight the importance of maintaining up-to-date security configurations and regularly reviewing software dependencies for vulnerabilities. As always, timely patching and regular security audits are essential to mitigating the risk of a successful attack.
Source: SecurityWeek — 2026-11-11