CVE-2026-121653

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ivanti	Endpoint Manager	—

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-121665.5A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser CVE-2026-1216607.5Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216617.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1216628.6Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to CVE-2026-1216638.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216648.3Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker t CVE-2026-1216658.8Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216687.7Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.CVE-2026-1216696.1Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.CVE-2026-121677.8The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver fun CVE-2026-1216707.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized a CVE-2026-1216717.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.