- November 11, 2026
Critical SQL Injection in Ivanti Endpoint Manager (CVE-2026-121653)
Ivanti fixed a critical SQL injection in the Endpoint Manager Core that allows unauthenticated remote code execution.
Executive Summary
On November 10th, 2026, Ivanti disclosed a critical vulnerability in its Endpoint Manager (EPM) product as part of its November security update. Tracked as CVE-2026-121653, the flaw is a SQL injection in the EPM Core server that lets an unauthenticated, remote attacker execute code on the server.
Ivanti Endpoint Manager is a centralized platform that organizations use to inventory, patch, and deploy software to their managed endpoints. A compromised EPM Core gives an attacker a privileged position from which to reach the devices it manages. Earlier SQL injection flaws in Endpoint Manager also led to code execution on management servers, and attackers have repeatedly targeted Ivanti's endpoint and remote access products. Ivanti has released a fixed version.
Ivanti states it is not aware of any customers being exploited through this vulnerability at the time of disclosure, and no public proof of concept has been reported. However, unauthenticated code execution flaws in Ivanti management products have historically been weaponized following disclosure. Beazley Security recommends affected organizations apply available fixes as soon as possible.
Mitigations / Workarounds
Ivanti has not published a workaround for this vulnerability. Upgrading to Endpoint Manager 2024 SU8 remediates it.
If organizations are unable to upgrade immediately, the following step may help reduce risk in the interim:
Restrict network access to the EPM Core server so that only managed endpoints and trusted administrative networks can reach it, and ensure it is not exposed to the internet.
Network restriction reduces exposure but does not remove the vulnerability, since any attacker who can reach the Core can still attempt exploitation.
Patches
Ivanti has released Endpoint Manager 2024 SU8, which resolves this vulnerability. The update is available to customers through the Ivanti License System, and additional information can be found in Ivanti's November 2026 security advisory for Endpoint Manager.
Technical Details
CVE-2026-121653 is a SQL injection in the EPM Core server, the central component that stores inventory, policy, and deployment data for every managed device. An attacker sends crafted input to the Core over the network. The Core fails to neutralize that input before placing it in a database query, so the attacker controls part of the query.
Ivanti states this access is enough to reach remote code execution on the server and preconditions are minimal as the attacker needs no credentials, no user interaction, and no special configuration beyond network access to the Core.
Public technical detail is limited and Ivanti has not named the vulnerable function or endpoint. This issue came in through Ivanti's responsible disclosure program, and no proof of concept has been published at the time of writing.
How Beazley Security is responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.