Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-121653 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Ivanti |
| Product | Endpoint Manager |
| Vulnerability Type | SQL injection leading to remote code execution (CWE-89) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
Required Actions
- Update the Ivanti EPM Core server to 2024 SU8 as per Ivanti’s November advisory.
- Restrict network access to the Core server — it should not be exposed to the internet.
- The EPM server manages every endpoint in the organization: after updating, review logs and deployment tasks for unauthorized activity.
Who Is Affected?
The vulnerability affects Ivanti Endpoint Manager (EPM) versions before 2024 SU8. Compromising the Core server lets an attacker push software to every managed endpoint — the impact can extend to the whole organization.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-121653 vulnerability?
CVE-2026-121653 is a SQL injection flaw (CWE-89) in the Core of Ivanti Endpoint Manager leading to remote code execution. CVSS score: 9.8.
Does exploiting CVE-2026-121653 require authentication?
No. The attack is carried out remotely and requires no authentication or user interaction.
How to protect against CVE-2026-121653?
Update Ivanti EPM to 2024 SU8 and restrict network access to the Core server.
Who is affected by CVE-2026-121653?
Organizations running Ivanti Endpoint Manager versions before 2024 SU8.
