Ivanti patches unauthenticated flaws in Endpoint Manager and CSA
CVE-2026-121653 scores 9.8 and allows unauthenticated SQL injection code execution on Endpoint Manager Core before 2024 SU8.
68
CVE-2026-83528
PII exposure in Ivanti EPMM before patched releases
- CVSS 3.1
- 4.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Ivanti Endpoint Manager Mobile (EPMM) exposes GDPR-protected user information. A remote attacker who already has administrator privileges can trigger the leak over the network without user interaction and obtain that personal data. EPMM builds before 12.10.0.1, 12.9.0.3, and 12.8.0.5 are affected.
What to do: Upgrade Ivanti EPMM to 12.10.0.1, 12.9.0.3, or 12.8.0.5.
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti EPMM | before 12.10.0.1, 12.9.0.3, and 12.8.0.5 | 12.10.0.1, 12.9.0.3, and 12.8.0.5 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.
- Weakness
- CWE-359
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
In the news
2 storiesIvanti patches unauthenticated SQL injection RCE in Endpoint Manager
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
66