{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121683","assignerOrgId":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","state":"PUBLISHED","assignerShortName":"ivanti","dateReserved":"2026-11-03T19:21:10.885Z","datePublished":"2026-11-10T15:33:51.737Z","dateUpdated":"2026-11-10T15:33:51.737Z"},"containers":{"cna":{"providerMetadata":{"orgId":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","shortName":"ivanti","dateUpdated":"2026-11-10T15:33:51.737Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-306","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 – Authentication Bypass"}]}],"affected":[{"vendor":"Ivanti","product":"Cloud Services Application","versions":[{"status":"unaffected","version":"5.0.8"}],"defaultStatus":"affected"}],"descriptions":[{"lang":"en","value":"Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.","supportingMedia":[{"type":"text/html","base64":false,"value":"Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries. "}]}],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-CVE-2026-121683?language=en_US"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"}}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}