External risk intelligence

SQL Injection in Ivanti Endpoint Manager Core Enables Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121653

Ivanti Endpoint Manager is an enterprise management product. While administrative consoles for such software are often restricted, they are frequently deployed as network-accessible management services that may be exposed to the internet or wide internal networks to support remote device management and agent communication, making remote reachability a common deployment characteristic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Ivanti Endpoint Manager, a technology used for managing endpoints. This issue could allow unauthorized remote access and potentially lead to the execution of malicious code, impacting the integrity and availability of systems. The main concern is confirming relevance and exposure to this technology.

Unauthenticated remote code execution flaw.
Manages endpoints, a core IT function.
Confirm if Ivanti Endpoint Manager is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to an exposed Ivanti Endpoint Manager instance. This could allow them to execute arbitrary code on the server, potentially leading to a complete system compromise.

Entry condition: Network accessible endpoint.
Trigger point: Unauthenticated network request.
Resulting risk: Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical SQL injection vulnerability in Ivanti Endpoint Manager could allow an unauthenticated attacker to execute arbitrary code on a system. This could occur when the affected service is accessible over a network, potentially leading to a compromise of the system's integrity and confidentiality.

System code and sensitive data.
Exploiting network-accessible services.
Remote code execution and data breaches.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Ivanti Endpoint Manager directly impacts the security and integrity of endpoint management capabilities. Platform or infrastructure teams managing the Ivanti deployment are likely responsible for remediation. The immediate first step is to inventory all Ivanti Endpoint Manager instances, assess their network exposure, and identify business-critical systems. Following this, confirm the accountable owner and begin planning remediation activities, prioritizing based on exposure and criticality.

Platform or Infrastructure teams should own.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Endpoint Manager?

Ivanti Endpoint Manager is an enterprise IT solution designed to manage, secure, and monitor devices across an organization. It functions as a centralized hub for deploying software, enforcing security policies, and managing system configurations on remote workstations and servers, ensuring they remain updated and compliant.

What does SQL injection mean for CVE-2026-121653?

This CVE involves CWE-89, or SQL injection, a weakness where an application fails to properly filter user input before processing it in a database query. In this specific case, an attacker can manipulate these queries to send unauthorized commands to the underlying database, ultimately allowing them to execute arbitrary code on the affected server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network requests to the Ivanti Endpoint Manager core. Because it does not require authentication, the request does not need to come from a logged-in user. However, the system must be reachable over a network to receive the malicious input.

Is my system at risk if it is not on the internet?

Halo Surface Signal notes that while internet-facing instances are at higher risk, these management services are often accessible across wide internal networks to communicate with various agents. If your instance is reachable via any network path that an attacker might traverse, it should be considered potentially exposed.

How should I respond to this threat advisory?

Your first step is to perform a comprehensive inventory of all Ivanti Endpoint Manager instances within your environment. Once identified, evaluate the network accessibility of each server and determine its business criticality. Use this assessment to coordinate with your infrastructure teams to prioritize and plan the necessary security updates.

References

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-E…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.