--- schema: 1 kind: vulnerability title: "CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud Services Application that edits trusted EPM Core certificates (CVE-2026-121683, 9.4)" headline: "Ivanti EPM Core: unauthenticated SQL injection to RCE, fixed in 2024 SU8; Cloud Services cert flaw; no known exploits" summary: > Ivanti's CNA records of 2026-11-10 describe CVE-2026-121653, an SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8 that lets a remote unauthenticated attacker reach remote code execution (CVSS 3.1 9.8), and CVE-2026-121683, missing authentication in Ivanti Cloud Services Application 5.0.8 that lets a remote unauthenticated attacker add and delete trusted EPM Core certificate entries (9.4). The records state no exploitation; Ivanti's own advisory pages could not be read, so the fixed Cloud Services Application build is not known. discovered_at: "2026-11-11T03:38:30Z" updated_at: null event_date: "2026-11-10" run_id: 2026-11-11T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, pre-auth, sqli, rce, auth-bypass, patch-available] regions: [global] sectors: [] entities: ["product:ivanti-endpoint-manager", "product:ivanti-cloud-services-application"] techniques: [T1190] affected_products: ["Ivanti Endpoint Manager", "Ivanti Cloud Services Application"] cves: - id: CVE-2026-121653 cvss: "9.8" epss: null type: sqli vector: zero-click auth: pre-auth status: [patch-available] affected: "Ivanti Endpoint Manager before 2024 SU8" fixed: "2024 SU8" sources: - url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121248" publisher: "ENISA EUVD (Ivanti CNA record, CVE-2026-121653)" date: "2026-11-10" role: primary - url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121155" publisher: "ENISA EUVD (Ivanti CNA record, CVE-2026-121683)" date: "2026-11-10" role: primary closed_sources: [] evidence: - quote: "SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution." publisher: "ENISA EUVD (Ivanti CNA record, CVE-2026-121653)" source_url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121248" - quote: "Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries." publisher: "ENISA EUVD (Ivanti CNA record, CVE-2026-121683)" source_url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121155" verification: single-source sourcing_note: > The only sources are Ivanti's own CNA records as ENISA's vulnerability database republishes them; Ivanti's advisory pages are a script-built application that could not be read, so its exploitation statement, mitigations and the fixed Cloud Services Application build were not seen, and neither record names the port or interface the Core exposes. No exploitation is stated in the records, and ENISA shows none. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every Ivanti Endpoint Manager Core server to 2024 SU8 or later, and read Ivanti's advisory for the fixed Cloud Services Application build before treating 5.0.8 as patched, because the CNA record gives an unauthenticated path to code execution on the server that distributes software to the managed endpoints." updates: [] migrated_from: null --- Ivanti's CNA records of 2026-11-10 describe CVE-2026-121653 as an SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8 that "allows a remote unauthenticated attacker to achieve remote code execution", scored CVSS 3.1 9.8 with a network vector, low complexity, no privileges and no user interaction ([Ivanti via ENISA EUVD, 2026-11-10](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121248)). A second record, CVE-2026-121683, describes missing authentication in Ivanti Cloud Services Application version 5.0.8 that lets a remote unauthenticated attacker add and delete arbitrary trusted EPM Core certificate entries, scored 9.4 ([Ivanti via ENISA EUVD, 2026-11-10](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-121155)). The first is fixed in 2024 SU8; the second record names 5.0.8 as the affected version in its text and again in its patch field, so it does not settle which build fixes it. Neither record states exploitation, and Ivanti's advisory pages, which would carry the exploitation statement and mitigations, could not be read, so the whole account rests on the two CNA records. **Exposure:** an Ivanti Endpoint Manager Core server below 2024 SU8 that an attacker can reach; the records do not say which port or interface carries the injectable request. A trusted-certificate store that an unauthenticated caller can edit weakens the trust the Core places in the Cloud Services Application and its appliances. **Detection:** no indicator is published; the signals that follow from the mechanism are SQL syntax or errors in requests to the Core's web service, child processes of that service, and trusted-certificate entries nobody approved. **Defender takeaway:** upgrade the Core to 2024 SU8 or later and confirm the Cloud Services Application's fixed build with Ivanti before relying on 5.0.8; an endpoint-management server is a software-distribution channel to the whole estate, so an unauthenticated path to code execution on it warrants an out-of-cycle update even without reported exploitation.