CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud Services Application that edits trusted EPM Core certificates (CVE-2026-121683, 9.4)
Ivanti EPM Core: unauthenticated SQL injection to RCE, fixed in 2024 SU8; Cloud Services cert flaw; no known exploits
Defender actions
- Upgrade every Ivanti Endpoint Manager Core server to 2024 SU8 or later, and read Ivanti's advisory for the fixed Cloud Services Application build before treating 5.0.8 as patched, because the CNA record gives an unauthenticated path to code execution on the server that distributes software to the managed endpoints.
Analysis
Ivanti's CNA records of 2026-11-10 describe CVE-2026-121653 as an SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8 that "allows a remote unauthenticated attacker to achieve remote code execution", scored CVSS 3.1 9.8 with a network vector, low complexity, no privileges and no user interaction (Ivanti via ENISA EUVD, 2026-11-10). A second record, CVE-2026-121683, describes missing authentication in Ivanti Cloud Services Application version 5.0.8 that lets a remote unauthenticated attacker add and delete arbitrary trusted EPM Core certificate entries, scored 9.4 (Ivanti via ENISA EUVD, 2026-11-10). The first is fixed in 2024 SU8; the second record names 5.0.8 as the affected version in its text and again in its patch field, so it does not settle which build fixes it. Neither record states exploitation, and Ivanti's advisory pages, which would carry the exploitation statement and mitigations, could not be read, so the whole account rests on the two CNA records.
Cited evidence
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.