CriticalCVSS9.82026-11-12
CVE-2026-121653 — Ivanti Endpoint Manager SQL injection (unauthenticated remote code execution, CVSS 9.8): explainer and fix (fixed in 2024 SU8)
A SQL injection (CWE-89) in the Core of Ivanti Endpoint Manager (EPM). Ivanti's advisory says a remote, unauthenticated attacker could achieve remote code execution, with a CVSS score of 9.8 (Critical). Versions 2024 SU7 and prior are affected; the fix is 2024 SU8. Ivanti says it is not aware of customers being exploited at the time of disclosure, and the CVE is not in KEV. A separate product, Cloud Services Application (CVE-2026-121683, 9.4), was fixed the same day. This site's view: an endpoint-management server is a springboard to every device it manages, so move to 2024 SU8 quickly even though no exploitation is reported, and check that the server is not exposed to the internet.