{"id":"CVE-2026-121653","published":"2026-11-10T16:17:17.580","lastModified":"2026-11-11T05:19:30.540","description":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability (CWE-89) exists in the Core component of Ivanti Endpoint Manager prior to version 2024 SU8, allowing unauthenticated remote attackers to inject malicious SQL and achieve remote code execution. This is critical due to the combination of no authentication requirement and full system compromise potential.","exploitability":"Exploitation is straightforward for remote unauthenticated attackers due to low attack complexity and no user interaction required.","blast_radius":"Successful exploitation could lead to full compromise of the Ivanti Endpoint Manager server, including data exfiltration, lateral movement within managed endpoints, and disruption of endpoint management operations across the enterprise.","remediation":"Upgrade Ivanti Endpoint Manager to version 2024 SU8 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","rce","unauthenticated","endpoint-management","ics"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:01.021Z"}}