Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Ivanti Endpoint Manager can be hijacked to run code

CVE-2026-121653 · published 1 day ago
Summary

The core of Ivanti Endpoint Manager before the 2024 SU8 update can be tricked into executing unwanted commands from anyone on the internet. This means an attacker could take control of the system without needing any credentials. Apply the latest update or patch to protect your environment.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ivanti endpoint manager All versions
Original advisory text
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published10 Nov 2026
Updated12 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-121653 · NVD
CVE-2026-121653 · MITRE
Track software like this
Free during beta