Ivanti and Zoom Patch Critical Flaws as Citrix and Asus Ship Fixes

By Sophie Lindqvist

Ivanti disclosed 13 vulnerabilities across five products on Nov. 10, including critical flaws rated CVSS 9.8 and 9.4. Zoom separately patched a CVSS 9.6 privilege-escalation flaw. Neither vendor reported exploitation.

The releases widened a Patch Tuesday week already carrying hundreds of fixes from Microsoft, Fortinet, SAP, Adobe, Intel and AMD. Microsoft’s November release contained 1,093 fixes, including an exploited Outlook zero-day. Fortinet shipped nearly 100 fixes on Nov. 10.

What did Ivanti disclose?

Ivanti classified two of its 13 disclosures as critical.

• CVE-2026-121653 scored 9.8. The unauthenticated SQL injection in Endpoint Manager can lead to remote code execution. Endpoint Manager 2024 SU8 fixes it and also a medium-severity cleartext-transmission bug.
• CVE-2026-121683 scored 9.4. The missing-authentication flaw in Cloud Services Application lets a remote, unauthenticated attacker “add and delete arbitrary trusted EPM Core certificate entries.” Version 5.0.8.1 patches it. Ivanti said dual-NIC deployments cannot be exploited externally.

Four Sentry flaws included high-severity remote-code-execution bug CVE-2026-105425, which also affects Endpoint Manager Mobile. Ivanti also fixed five medium-severity Endpoint Manager Mobile issues and one User Workspace Manager vulnerability. Its 13-issue count mixes critical, high and medium risks rather than 13 equivalent exposures.

Will AI-assisted testing expand the workload?

Ivanti said it has built “multiple advanced LLM models” into its product security work. The models found vulnerabilities traditional tools missed, “including some that we are disclosing today,” Ivanti said. The company expects disclosure volume to rise.

That is an expectation, not a measured gain. The announcement provides no detection rate, false-positive rate or independent validation. Fortinet made a similar AI-testing claim on Nov. 10 while shipping nearly 100 fixes.

What did Zoom patch?

Zoom’s CVE-2026-108186 scored 9.6. Improper input validation in Zoom Workplace for Windows allows a remote, unauthenticated attacker to escalate privileges. A second flaw, CVE-2026-108187, scored 8.1. It is an origin-validation error that can also enable remote, unauthenticated privilege escalation.

Zoom Workplace for Windows 7.1.8 and later contain both fixes. Zoom reported no exploitation, but that statement captures its disclosure knowledge rather than proving that no attempted attacks occurred.

What did Citrix and Asus address?

Citrix rated its XenServer bulletin high severity, not critical. CVE-2026-102705 may let an unauthenticated attacker on the management network “eventually infer the Pool Secret and so compromise the host.” Citrix directed customers to instructions for rotating the Pool Secret.

Updates for XenServer 8.4 and 9 also carry AMD microcode mitigating CPU flaws. Those flaws could let a guest virtual machine compromise its host or read memory from another virtual machine.

Five more XenServer flaws let authenticated administrators escalate to Pool Administrator or terminate other roles’ running tasks. Their authenticated prerequisite differs materially from Citrix’s unauthenticated management-network path.

Asus published an advisory for four high- and medium-severity flaws in some router firmware. Successful attacks could run commands as root or crash the device by overwriting memory. Asus described the affected scope only as “some router firmware.”

No vendor said any newly disclosed flaw had been exploited.

What should customers watch?\n

Exposure now depends on product, version and network position. Endpoint Manager 2024 SU8, Cloud Services Application 5.0.8.1 and Zoom Workplace for Windows 7.1.8 are the named fixed releases. The dual-NIC restriction applies only to Cloud Services Application, while Citrix’s unauthenticated path requires management-network access.

Ivanti expects LLM-assisted testing to increase disclosures, while Fortinet made a similar claim on the same day. The vendors are competing to find flaws faster, but neither announcement supplied comparative detection data, so the expected efficiency gain remains unmeasured.