Ivanti patches unauthenticated SQL injection RCE in Endpoint Manager
Original title: Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login
CVE-2026-121653 scores 9.8 in EPM before 2024 SU8; Ivanti says no known customer exploitation.
Ivanti's November 2026 updates cover Endpoint Manager, EPMM, Sentry, Cloud Services Application and User Workspace Manager. The highest-rated issue, CVE-2026-121653, is unauthenticated SQL injection leading to remote code execution in EPM Core before 2024 SU8. CSA 5.0.8 has a 9.4 missing-authentication flaw fixed in 5.0.8.1. Ivanti said the issues came through responsible disclosure and it knows of no customer exploitation.
Unconfirmed: Ivanti reports no known exploitation and supplied no vulnerability-specific compromise indicators.
- EPM 2024 SU7 and earlier are fixed in SU8.
- Only CSA 5.0.8 is affected; 5.0.7 and earlier are not.
- Fixed EPMM releases are 12.11.0.0, 12.10.0.1 and 12.9.0.3.
- Sentry fixes include 11.0.0, 10.8.3 and 10.7.4.
- UWM 2026.4 fixes a medium cleartext session-storage flaw.
Impact: Unauthenticated remote code execution via SQL injection
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Endpoint Manager | 2024 SU7 and earlier | 2024 SU8 |
| Ivanti Cloud Services Application | 5.0.8 | 5.0.8.1 |
| Ivanti Endpoint Manager Mobile | — | 12.11.0.0, 12.10.0.1, 12.9.0.3 |
| Ivanti Sentry | — | 11.0.0, 10.8.3, 10.7.4 |
| Ivanti User Workspace Manager | — | 2026.4 |
- 1.Install EPM 2024 SU8 and CSA 5.0.8.1 first for unauthenticated exposure.
- 2.Update EPMM to 12.11.0.0, 12.10.0.1 or 12.9.0.3, and Sentry to a listed fix.
- 3.Install UWM 2026.4 and verify installed versions after updating.
- CVEs
- CVE-2026-121653CVE-2026-18128CVE-2026-121683CVE-2026-105425CVE-2026-105426CVE-2026-105427CVE-2026-107404CVE-2026-83528CVE-2026-107405CVE-2026-105669CVE-2026-123179CVE-2026-123181CVE-2026-105813
- Vendors
- Ivanti
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105425+2 related CVEs | OS command injection in Ivanti Sentry and EPMM (admin) | 7.2 group max | — | ||
CVE-2026-121653+2 related CVEs | Unauthenticated SQL injection to RCE in Ivanti Endpoint Manager | 9.8 group max | — | ||
CVE-2026-107405+3 related CVEs | Local DoS via exposed function in Ivanti EPMM | 5.5 group max | — | ||
| CVE-2026-105813 | Cleartext session-token storage in Ivanti UWM before 2026.4 | 6.3 | — | ||
| CVE-2026-121683 | Missing authentication in Ivanti Cloud Services Application 5.0.8 | 9.4 | — | ||
| CVE-2026-123179 | Local DoS from insecure init in Ivanti Sentry shutdown listener | 5.5 | — |
From the original article
2 min read at gbhackers.com
Ivanti has released November 2026 security updates for Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Application (CSA), and User Workspace Manager (UWM). The flaws expose systems to remote code execution, certificate changes, data theft, and service disruption. Critical EPM and CSA vulnerabilities require immediate attention.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.