CVE-2026-121653

CVE-2026-121653

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

Vulnerability class: SQL Injection

Published 2026-11-10 · last modified 2026-11-12.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.020, 80.8th percentile (scored 2026-11-12). About EPSS.

Weakness classification (CWE)

CWE-89 — SQL Injection

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

googlesky/CVE-2026-121653 (last pushed 2026-11-12): Containerised PoC for CVE-2026-121653: unauthenticated SQL injection (CWE-89) in the Ivanti Endpoint Manager Core status-event service leads to RCE through the Core database account. A model of /WSSt…

References

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November…

This CVE has public exploit evidence. See the latest CVEs with public exploits.