{"id":"CVE-2026-121683","published":"2026-11-10T16:17:17.900","lastModified":"2026-11-10T16:17:17.900","description":"Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-CVE-2026-121683?language=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Ivanti Cloud Services Application v5.0.8 lacks authentication for a critical certificate management endpoint, allowing unauthenticated remote attackers to add or delete trusted EPM Core certificates. This enables attackers to impersonate legitimate services or bypass certificate-based trust controls.","exploitability":"Exploitation requires no authentication or user interaction and is trivial for any remote attacker with network access to the affected service.","blast_radius":"Successful exploitation could allow an attacker to inject malicious trusted certificates, leading to man-in-the-middle attacks, unauthorized system access, or compromise of downstream EPM Core communications.","remediation":"Upgrade to Ivanti Cloud Services Application version 5.0.9 or later, which addresses this missing authentication flaw per vendor advisory.","detection":"Defenders should monitor for unauthenticated HTTPS requests to certificate management endpoints (e.g., /api/certificates) that result in POST or DELETE operations; such activity without valid session tokens or API keys is highly suspicious. Review access logs for requests originating from non-trusted IP ranges targeting privileged certificate endpoints.","tags":["auth-bypass","certificate-trust","remote-exploit","ics","critical-severity"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:56:16.423Z"}}