CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud...

cve · CVE-2026-121653 single-source

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Ivanti EPM Core: unauthenticated SQL injection to RCE, fixed in 2024 SU8; Cloud Services cert flaw; no known…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-121653, newest first. Check the date before acting on an older one.

  • Upgrade every Ivanti Endpoint Manager Core server to 2024 SU8 or later, and read Ivanti's advisory for the fixed Cloud Services Application build before treating 5.0.8 as patched, because the CNA record gives an unauthenticated path to code execution on the server that distributes software to the managed endpoints.
    2026-11-11CVE-2026-121653

Defender insights

What each entry about CVE-2026-121653 tells a defender to do, newest first.

2026-11-11NOTABLEIvanti EPM Core: unauthenticated SQL injection to RCE, fixed in 2024 SU8; Cloud Services cert flaw; no known exploits

Exposure · detection

Story timeline

  1. 2026-11-11CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud Services Application that edits trusted EPM Core certificates (CVE-2026-121683, 9.4)
    trending-vulnerabilitiesIvanti EPM Core: unauthenticated SQL injection to RCE, fixed in 2024 SU8; Cloud Services cert flaw; no known exploits

Hunting pivots

Affected products
Ivanti Cloud Services ApplicationIvanti Endpoint Manager
Tags
auth-bypasspatch-availablepre-authrcesqlivulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-11/ivanti-epm-cve-2026-121653-unauthenticated-sqli-rce · ATT&CK page ↗

Entries about CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud... (1)

2026-11-11 · view entry permalink →

NOTABLECVE-2026-121653NATOA2

CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud Services Application that edits trusted EPM Core certificates (CVE-2026-121683, 9.4)

Ivanti's CNA records of 2026-11-10 describe CVE-2026-121653 as an SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8 that "allows a remote unauthenticated attacker to achieve remote code execution", scored CVSS 3.1 9.8 with a network vector, low complexity, no privileges and no user interaction (Ivanti via ENISA EUVD, 2026-11-10). A second record, CVE-2026-121683, describes missing authentication in Ivanti Cloud Services Application version 5.0.8 that lets a remote unauthenticated attacker add and delete arbitrary trusted EPM Core certificate entries, scored 9.4 (Ivanti via ENISA EUVD, 2026-11-10). The first is fixed in 2024 SU8; the second record names 5.0.8 as the affected version in its text and again in its patch field, so it does not settle which build fixes it. Neither record states exploitation, and Ivanti's advisory pages, which would carry the exploitation statement and mitigations, could not be read, so the whole account rests on the two CNA records.

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

ENISA EUVD (Ivanti CNA record, CVE-2026-121653) 2026-11-10

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.

ENISA EUVD (Ivanti CNA record, CVE-2026-121683) 2026-11-10
vulnerability11 Nov 03:38Zsingle-sourceOpen finding →
Sources: ENISA EUVD (Ivanti CNA record, CVE-2026-121653) · ENISA EUVD (Ivanti CNA record, CVE-2026-121683)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvdservices.enisa.europa.eu2 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)