CVE-2026-121653
CVSS 9.8 CRITICAL: sQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker… EPSS 2% (81st percentile).
Vulnerabilities · 15h ago
NCSC-NL’s November 12 advisory identifies two flaws in Ivanti Endpoint Manager, narrowing the earlier 13-vulnerability Ivanti roundup to this product. One is an unauthenticated SQL injection in the Core component that can lead to remote code execution. Both flaws affect versions before 2024 SU8; Ivanti has released fixes.
In Core, an external attacker can send malicious Structured Query Language (SQL) commands without logging in, potentially making it run code. Separately, the Agent sends sensitive information in unencrypted HTTP traffic; an attacker positioned between it and its peer can read or alter that traffic, undermining confidentiality and integrity.
For organizations running affected versions, Core’s reachability—not a stolen account—is the key boundary: if an attacker can reach it, the potential impact extends to code execution on Endpoint Manager itself. The advisory does not establish whether that could expose systems managed through it.
CVSS 9.8 CRITICAL: sQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker… EPSS 2% (81st percentile).
CVSS 6.8 MEDIUM: cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8… EPSS 0.4% (39th percentile).
5 sources covering this story
Kwetsbaarheden verholpen in Ivanti Endpoint Manager
De eerste kwetsbaarheid (CVE-2026-121653) betreft een SQL-injectie in de Core van Ivanti Endpoint Manager-versies vóór 2024 SU8.
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.
Múltiples vulnerabilidades en productos de Ivanti
Ivanti ha publicado 3 vulnerabilidades, 2 de severidad crítica y una media.
Ivanti November Security Update
Rilasciati gli aggiornamenti di sicurezza di novembre che risolvono 13 vulnerabilità, di cui due con gravità “critica” e una con gravità “alta”, in alcuni prodotti. Tali vulnerabilità potrebbero consentire a un attaccante remoto di eseguire codice arbitrario o di aggiungere ed eliminare arbitrariamente certificati attendibili sui sistemi interessati.
Ivanti is disclosing vulnerabilities in Ivanti User Workspace Manager, Ivanti Sentry, Ivanti Endpoint Manager Mobile, Ivanti Cloud Services Application and Ivanti Endpoint Manager.
Part of the PlainSec briefing for 2026-11-13