SecurityWeek reported that Citrix and Ivanti announced fixes for 19 flaws on Tuesday. Ivanti fixed 13 across five products. Two are critical. The Cloud Services Application flaw, CVE-2026-121683, scores 9.4. It is a missing login check that lets a remote attacker add and delete trusted certificate entries. The Endpoint Manager flaw, CVE-2026-121653, scores 9.8. It is an SQL injection, where an attacker slips database commands into an input. SecurityWeek says it could allow remote code execution without logging in. Citrix fixed six XenServer flaws. The high-severity one could let attackers infer the Pool Secret and take over the host.
Ivanti says it has no evidence that any of its 13 flaws are being exploited. The sources do not say whether the Citrix flaws are under attack. SecurityWeek says Cloud Services Application setups with a Dual NIC configuration cannot be exploited from outside. Ivanti says its AI tools found flaws that older scanning tools missed, some of them disclosed Tuesday. It also says a human checks that work. The sources do not say how many customers are affected.
Ivanti says it expects more disclosures as it uses these tools further. Teams that run Ivanti products can plan for bigger monthly patch batches. They can also check whether their exposed Cloud Services Application setups use Dual NIC.