Vulnerabilities & Exploits

Ivanti Endpoint Manager SQL flaw puts Core at code-execution risk

NCSC-NL’s November 12 advisory identifies two flaws in Ivanti Endpoint Manager, narrowing the earlier 13-vulnerability Ivanti roundup to this product. One is an unauthenticated SQL injection in the Core component that can lead to remote code execution. Both flaws affect versions before 2024 SU8; Ivanti has released fixes.

In Core, an external attacker can send malicious Structured Query Language (SQL) commands without logging in, potentially making it run code. Separately, the Agent sends sensitive information in unencrypted HTTP traffic; an attacker positioned between it and its peer can read or alter that traffic, undermining confidentiality and integrity.

For organizations running affected versions, Core’s reachability—not a stolen account—is the key boundary: if an attacker can reach it, the potential impact extends to code execution on Endpoint Manager itself. The advisory does not establish whether that could expose systems managed through it.

5 sources · Nov 12

CVE-2026-121653

NVD KEV

CVSS 9.8 CRITICAL: sQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker… EPSS 2% (81st percentile).

CVE-2026-18128

NVD KEV

CVSS 6.8 MEDIUM: cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8… EPSS 0.4% (39th percentile).

Timeline

Nov 12 Reported by NCSC-NL Advisories
Nov 11 Reported by SecurityWeek
Nov 10 Reported by Ivanti Security Advisories

Sources

Nov 12 NCSC-NL Advisories
Kwetsbaarheden verholpen in Ivanti Endpoint Manager
De eerste kwetsbaarheid (CVE-2026-121653) betreft een SQL-injectie in de Core van Ivanti Endpoint Manager-versies vóór 2024 SU8.
original
Nov 11 SecurityWeek
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.
original
Nov 11 INCIBE-CERT
Múltiples vulnerabilidades en productos de Ivanti
Ivanti ha publicado 3 vulnerabilidades, 2 de severidad crítica y una media.
original

Vendor digest: Ivanti

Part of the PlainSec briefing for 2026-11-11

Every edition of this story: Ivanti Endpoint Manager SQL flaw puts Core at code-execution risk

More from today

Vulnerabilities & ExploitsIvanti Endpoint Manager SQL flaw puts Core at code-execution riskNCSC-NL’s November 12 advisory identifies two flaws in Ivanti Endpoint Manager, narrowing the earlier 13-vulnerability Ivanti roundup to this product. One is an unauthenticated SQL injection in the Core component that can lead to remote code execution. Both flaws affect versions before 2024 SU8; Ivanti has released fixes.In Core, an external attacker can send malicious Structured Query Language (SQL) commands without logging in, potentially making it run code. Separately, the Agent sends sensitive information in unencrypted HTTP traffic; an attacker positioned between it and its peer can read or alter that traffic, undermining confidentiality and integrity.For organizations running affected versions, Core’s reachability—not a stolen account—is the key boundary: if an attacker can reach it, the potential impact extends to code execution on Endpoint Manager itself. The advisory does not establish whether that could expose systems managed through it.5 sources · Nov 12

CVE-2026-121653

NVD KEV

CVSS 9.8 CRITICAL: sQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker… EPSS 2% (81st percentile).

CVE-2026-18128

NVD KEV

CVSS 6.8 MEDIUM: cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8… EPSS 0.4% (39th percentile).