CVE-2026-121653: SQL Injection

Published Nov 10, 2026

Updated

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ivanti Endpoint Manager to a version that resolves this vulnerability.
Fixed in 2024 SU8

Event History

Nov 10, 2026

CVE Published

via MITRE·03:28 PM

Data Sourced

via MITRE·03:28 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote, unauthenticated attacker can exploit the SQL injection vulnerability. No credentials or user interaction are required.

Which deployments are affected?

Ivanti Endpoint Manager versions before 2024 SU8 are affected. The available information does not identify any configuration prerequisite, so affected installations should be treated as exposed until updated.

What is the potential impact?

Successful exploitation can lead to remote code execution with high impact to confidentiality, integrity, and availability.

What is the recommended remediation?

Update Ivanti Endpoint Manager to version 2024 SU8 or later.

CVE-2026-121653: SQL Injection

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the potential impact?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the potential impact?

What is the recommended remediation?