Introduction
According to Ivanti's November 2026 advisory, an unauthenticated SQL injection in the Core server of Ivanti Endpoint Manager (EPM) can be turned into remote code execution. The flaw needs no credentials and no user interaction, and it is rated CVSS 9.8. It affects the server-side component that managed agents depend on, so the Core should be verified and updated promptly.
Ivanti describes itself as an enterprise IT and security software provider whose portfolio connects unified endpoint management, zero trust security, and service management. The company reports operating in 23 countries, with half of its employees and customers outside the United States. In October 2026, Ivanti announced that its Autonomous Endpoint Management solution was named a Leader in G2's Fall 2026 Enterprise Grid report for unified endpoint management. That points to broad enterprise use of its endpoint tooling, although it says nothing about the security of any particular product.
Technical information
Root cause
The NVD record describes CVE-2026-121653 as a SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 that "allows a remote unauthenticated attacker to achieve remote code execution." The weakness is mapped to CWE-89, improper neutralization of special elements used in an SQL command. In practice, attacker-supplied input becomes part of SQL query text that the Core server executes, instead of being passed to the database strictly as data.
Ivanti, acting as CNA, assigned the following CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The vector breaks down as follows:
- AV:N: the vulnerable path is reachable over the network.
- AC:L: attack complexity is low.
- PR:N / UI:N: no privileges and no user interaction are required.
- S:U: scope is unchanged.
- C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.
NVD shows the CNA score of 9.8 (Critical). The NIST assessment field is currently not provided, so no separate NIST score exists yet.
What is not public
EPM is closed source, and Ivanti has not published a commit, diff, or changelog that identifies the changed Core endpoint or query. The advisory names only the bug class and its impact. As a result, none of the following is publicly known:
- The affected URL, request type, or injectable parameter
- The backing database engine
- Any prerequisites beyond the stated lack of authentication
- How the SQL injection is escalated to code execution
- Whether the SU8 fix uses parameterized queries, input validation, a new authentication check, or reduced database privileges
Any claim about the exact code change should be treated as speculation until someone publishes a patch diff analysis comparing SU7 with SU8. In general, a sound fix for SQL injection ensures that user input reaches the database only as bound parameters. For a bug that leads to RCE, a sound fix also restricts what the database account behind the Core can do, so that a single injected query cannot become code execution. Ivanti has not confirmed which of these approaches SU8 takes.
Attack flow
Based only on the published description and CVSS vector, the attack proceeds at a high level as follows:
- An attacker reaches, over the network, an EPM Core server running 2024 SU7 or earlier.
- Without authenticating, the attacker sends a request that carries crafted input to the vulnerable Core functionality.
- The Core includes that input in a SQL command without proper neutralization (CWE-89).
- The injected SQL results in remote code execution on the Core server, through a mechanism Ivanti has not disclosed.
Exploitation status
At disclosure, Ivanti reportedly stated that it was not aware of customers being exploited by the vulnerabilities in this advisory. Ivanti says it learned of the issue through its responsible disclosure program. The sources we reviewed do not name a threat actor, a campaign, a public proof of concept, or indicators of compromise for this CVE. Because Ivanti's statement applies only to the time of disclosure, it should not be read as evidence that exploitation has not occurred.
Patch information
Ivanti fixed CVE-2026-121653 in Ivanti Endpoint Manager (EPM) 2024 SU8, released on November 10, 2026, as part of the November 2026 Security Advisory Ivanti EPM (Multiple CVEs) (Ivanti article 000110070). The NVD record links to that advisory and uses the same version boundary: in Ivanti's CNA data, 2024 SU8 is marked "Unaffected."
What the fix covers
- Component: EPM Core server
- Weakness: CWE-89, SQL injection
- Affected versions: 2024 SU7 and earlier
- Fixed version: 2024 SU8
- Where to get it: Ivanti License System (ILS) download portal
- Severity: CVSS 9.8 (Critical),
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ivanti's only remediation instruction is to update to EPM 2024 SU8. The advisory does not list a standalone hotfix, a configuration workaround, or a backport for older release lines. For this CVE, the cumulative SU8 service update is the patch.
SU8 also fixes CVE-2026-18128, a medium-severity (6.8) cleartext transmission flaw in the EPM Agent (CWE-319). A single update therefore addresses both a server-side bug in the Core and a client-side bug in the Agent.
Confirming the fix is applied
Because the Core server is the vulnerable component, a deployment is remediated only when the Core server reports version 2024 SU8 or later. Updating managed agents alone does not fix this CVE. SU8 is a cumulative service update and must be installed on the Core, the same way earlier 2024 SUs were. Check the installed version afterwards.
Affected systems and versions
- Product: Ivanti Endpoint Manager (EPM)
- Vulnerable component: the Core server
- Affected: all versions before 2024 SU8, that is, 2024 SU7 and earlier
- Unaffected: 2024 SU8, as marked in Ivanti's CNA data on the NVD record
- Configuration: any Core server that an attacker can reach over the network, with no authentication or user interaction required
Vendor security history
This is not the first critical issue in Ivanti's endpoint management lines. In July 2024, CISA noted that Ivanti had released security updates for vulnerabilities in both Endpoint Manager and Endpoint Manager for Mobile, and that an actor could exploit some of them to take control of an affected system. In 2023, CISA reported that advanced persistent threat actors had exploited a vulnerability in Ivanti Endpoint Manager for Mobile (EPMM), for which Ivanti released a patch. EPMM is a separate product from the EPM Core component affected by CVE-2026-121653. This history is context for Ivanti's product security record. It is not evidence that this CVE has been exploited or is linked to those actors.
References
- NVD: CVE-2026-121653
- CVE.org record: CVE-2026-121653
- Ivanti: Security Advisory Ivanti Endpoint Manager (EPM), November 2026
- Rapid7 Vulnerability Database: CVE-2026-121653
- VulDB: CVE-2026-121653
- SecurityOnline: Ivanti Security Advisories, Critical Endpoint Manager RCE
- StackFlag: CVE-2026-121653, Ivanti Endpoint Manager can be hijacked to run code
- CISA Known Exploited Vulnerabilities Catalog
- CISA: Ivanti Releases Security Updates for Endpoint Manager (July 2024)
- CISA: Threat Actors Exploiting Ivanti EPMM Vulnerabilities (AA23-213A)
- Ivanti: About Us
- Ivanti: Autonomous Endpoint Management Named a Leader in G2 Fall 2026 Enterprise Grid Report
