{"id":"CVE-2026-121653","kind":"vulnerability","aliases":["CVE-2026-121653"],"related":[],"title":"Ivanti Endpoint Manager: SQL injection lets unauthenticated remote code execution","description":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.","summary":"Ivanti Endpoint Manager before 2024 SU8 has a SQL injection flaw in its Core component. A remote attacker without an account can inject SQL and reach remote code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint-manager","ivanti","on-prem","vendor","windows"],"not_affected_if":["patched-to-2024-su8"],"how_to_check":"- Confirm the installed Endpoint Manager version in the console or on the server; versions before `2024 SU8` are in scope.\n- Check whether the Core service is reachable from the internet or untrusted networks.","fix":"- Ivanti Endpoint Manager: upgrade to `2024 SU8` or later.","status":"open","published_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:23:15+00:00","updated_at":"2026-11-10T16:23:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T16:23:15Z","model":"claude-haiku-5-5","output":{"fix":"- Ivanti Endpoint Manager: upgrade to `2024 SU8` or later.","reach":"network","title":"Ivanti Endpoint Manager: SQL injection lets unauthenticated remote code execution","impact":"high","summary":"Ivanti Endpoint Manager before 2024 SU8 has a SQL injection flaw in its Core component. A remote attacker without an account can inject SQL and reach remote code execution on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti","endpoint-manager","on-prem","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code on the Endpoint Manager server unauthenticated","analyst_note":"Confirm exposure details and any Ivanti advisory for CVE-2026-121653; sources give only the NVD description.","how_to_check":"- Confirm the installed Endpoint Manager version in the console or on the server; versions before `2024 SU8` are in scope.\n- Check whether the Core service is reachable from the internet or untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-to-2024-su8"],"who_is_affected":"Organizations running Ivanti Endpoint Manager versions before 2024 SU8. The flaw sits in the Core component, so any deployment that exposes it to a network the attacker can reach is in scope. Sources do not say which network paths are exposed by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4518,"output_tokens":555,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-121653':13A,16A '-2026':12A,15A '2024':30B,69C 'account':46B 'achiev':77C 'allow':71C 'attack':43B,75C 'code':9A,53B,79C 'compon':40B 'core':39B,62C 'cve':11A,14A 'endpoint':2A,18B,27B,65C 'endpoint-manag':17B 'execut':10A,54B,80C 'flaw':36B 'inject':5A,35B,48B,59C 'ivanti':1A,20B,26B,64C 'let':6A 'manag':3A,19B,28B,66C 'on-prem':21B 'prem':23B 'reach':51B 'remot':8A,42B,52B,73C,78C 'server':57B 'sql':4A,34B,49B,58C 'su8':31B,70C 'unauthent':7A,74C 'vendor':24B 'version':68C 'window':25B 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Ivanti Endpoint Manager versions before 2024 SU8. The flaw sits in the Core component, so any deployment that exposes it to a network the attacker can reach is in scope. Sources do not say which network paths are exposed by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","endpointmanager","ivanti","onprem","vendor","windows"],"campaign_type":null,"search_a":"'-121653':13A,16A '-2026':12A,15A 'code':9A 'cve':11A,14A 'endpoint':2A 'execut':10A 'inject':5A 'ivanti':1A 'let':6A 'manag':3A 'remot':8A 'sql':4A 'unauthent':7A","search_b":"'2024':30B 'account':46B 'attack':43B 'code':53B 'compon':40B 'core':39B 'endpoint':18B,27B 'endpoint-manag':17B 'execut':54B 'flaw':36B 'inject':35B,48B 'ivanti':20B,26B 'manag':19B,28B 'on-prem':21B 'prem':23B 'reach':51B 'remot':42B,52B 'server':57B 'sql':34B,49B 'su8':31B 'vendor':24B 'window':25B 'without':44B","search_c":"'2024':69C 'achiev':77C 'allow':71C 'attack':75C 'code':79C 'core':62C 'endpoint':65C 'execut':80C 'inject':59C 'ivanti':64C 'manag':66C 'remot':73C,78C 'sql':58C 'su8':70C 'unauthent':74C 'version':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121653","severity":null,"published_at":"2026-11-10T16:17:17+00:00","modified_at":"2026-11-10T16:17:17+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}