An explainer on a SQL injection in Ivanti Endpoint Manager (EPM) that can lead to remote code execution without authentication. It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.
- CVE
- CVE-2026-121653 (Ivanti Endpoint Manager; SQL injection in the Core)
- Severity
- CVSS 9.8 (Critical; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; assigned by Ivanti. The advisory writes 3.0, the CVE record and NVD write 3.1)
- Type
- SQL injection (CWE-89)
- Impact
- Remote code execution by a remote, unauthenticated attacker
- Affected
- Ivanti Endpoint Manager 2024 SU7 and prior (the CVE record says "before 2024 SU8")
- Fix
- 2024 SU8 (from Ivanti's download portal, ILS)
- Published
- 10 November 2026
- Exploitation
- Ivanti states it is not aware of customers being exploited at the time of disclosure. Not in KEV as of 12 November 2026
Risk of waiting
Different product, but two Ivanti Connect Secure vulnerabilities were added to KEV on October 30, 2026 (see our Ivanti Connect Secure article). No exploitation of this EPM flaw is known, but unauthenticated, network-reachable, low-complexity flaws are the kind that get examined once they are public.
What kind of vulnerability is it
Ivanti's advisory says a SQL injection in the EPM Core lets a remote, unauthenticated attacker achieve remote code execution. It is classified as CWE-89.
- No authentication is required (PR:N), it works over the network, and no user interaction is needed (UI:N). Attack complexity is low (AC:L).
- CISA's SSVC assessment is exploitation none, automatable yes, technical impact total.
- The advisory does not describe the entry point or how the input is crafted, and this site does not either.
- Ivanti says the flaw was disclosed through its responsible disclosure program.
Affected scope
| Item | Detail |
|---|---|
| Product | Ivanti Endpoint Manager (EPM) Core |
| Affected versions | 2024 SU7 and prior (advisory). The CVE record says "before 2024 SU8" |
| Fixed version | 2024 SU8 (from ILS) |
| Workarounds / mitigations | None found in the advisory |
| Other CVE in the same advisory | CVE-2026-18128 (cleartext transmission in the Agent, CVSS 6.8, for an attacker in a man-in-the-middle position); also fixed in 2024 SU8 |
| Separate advisory | Cloud Services Application (CSA) 5.0.8, CVE-2026-121683 (missing authentication, CVSS 9.4). Fixed in CSA 5.0.8.1; CSA 5.0.7 and prior are not affected |
- Release lines older than 2024 (such as 2022) are not mentioned in the advisory. If you run one, ask Ivanti.
- For CSA, Ivanti says that with a Dual NIC configuration (Ivanti's recommended practice) exposure is limited to the internal interface and cannot be exploited externally.
How to check whether you are affected
Check the EPM version
In the EPM console, check the current version and Service Update (SU) number. 2024 SU7 or prior is affected. If you run several Cores, check each. For a larger estate, list them as described in the asset inventory checklist.
Check how widely the EPM Core is exposed
Look for any path that reaches the EPM Core from the internet side (open ports, reverse proxies, cloud exposure settings). If you manage remote devices with it, map which paths they use.
Check whether you use CSA
If you use Cloud Services Application, check whether it is 5.0.8. If so, update to 5.0.8.1.
What to do today
Update EPM to 2024 SU8 (top priority)
Get 2024 SU8 from Ivanti's download portal (ILS) and apply it. Back up the database and Core configuration first.
Limit access to the Core until you update
The advisory lists no workaround. As this site's addition, limit access to the Core to the management network and the devices that need it, and do not expose it directly to the internet. Check the impact on remote device management before closing paths.
Review logs from before the update
Look in web server and database logs for unexpected errors or traces of suspicious operations. Ivanti says there are no publicly known indicators of compromise at present. If you find something, follow the vulnerability remediation playbook.
Update CSA to 5.0.8.1 if you use it
If you run CSA 5.0.8, update to 5.0.8.1 and confirm it is in a Dual NIC configuration.
Subscribe to Ivanti's notifications
Ivanti publishes advisories on a regular schedule. Make sure someone notices them on the day they are published, so the next response is faster.
Exploitation status
- Ivanti's advisory states it is not aware of any customers being exploited by this vulnerability prior to public disclosure.
- The CVE is not in CISA's KEV catalog (KEV version 2026.11.10, checked 12 November 2026).
- CISA's SSVC assessment is exploitation none.
- NVD shows "Received" and has not analysed it. The 9.8 is Ivanti's value.
- No public information on the scale, techniques or actors of any attacks could be found.
Sources
- Ivanti — Security Advisory Ivanti Endpoint Manager (EPM) November 2026 (published 10 November 2026; affected and fixed versions, exploitation statement)
- Ivanti — Security Advisory Ivanti CSA (CVE-2026-121683) (the CSA advisory, with a mitigation)
- CVE.org — CVE-2026-121653 (published 10 November 2026; includes CISA's SSVC assessment)
- NVD — CVE-2026-121653 (Received; CVSS 9.8)
- CISA — Known Exploited Vulnerabilities Catalog (this CVE is not listed)
Limiting access to the Core to the management network is a general defence suggested by this site, not a workaround from Ivanti's advisory. Last verified: 12 November 2026.
Read next
- Same vendor: Ivanti Connect Secure vulnerabilities / Exploited edge device vulnerabilities
- Practice: Vulnerability remediation playbook / Asset inventory checklist
- Judgement: Prioritising with CVSS, EPSS and KEV
- Terms: What is SQL injection? / What is RCE?