---
id: "CVE-2026-121653"
page: "https://infrastack.ai/live/CVE-2026-121653"
kind: "vulnerability"
aliases: ["CVE-2026-121653"]
title: "Ivanti Endpoint Manager: SQL injection lets unauthenticated remote code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["endpoint-manager", "ivanti", "on-prem", "vendor", "windows"]
not_affected_if: ["patched-to-2024-su8"]
published_at: "2026-11-10T16:17:17+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:23:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121653", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Ivanti Endpoint Manager: SQL injection lets unauthenticated remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-121653 (this .md is for agents)

Ivanti Endpoint Manager before 2024 SU8 has a SQL injection flaw in its Core component. A remote attacker without an account can inject SQL and reach remote code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Endpoint Manager version in the console or on the server; versions before `2024 SU8` are in scope.
- Check whether the Core service is reachable from the internet or untrusted networks.

## Fix

- Ivanti Endpoint Manager: upgrade to `2024 SU8` or later.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121653

## From the sources

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_