Successful exploitation of CVE-2026-121653 could allow an unauthenticated attacker to achieve remote code execution
Successful exploitation of CVE-2026-121653 could allow an unauthenticated attacker to achieve remote code execution
The following platforms are known to be affected:
All prior to version 2024 SU8
Ivanti has released a security update covering two security fixes including a critical severity vulnerability in Ivanti EPM (Endpoint Manager).
CVE-2026-121653 - "SQL injection" vulnerability - CVSSv3.1 score: 9.8
CVE-2026-18128 - 'Cleartext transmission of sensitive information' vulnerability - CVSSv3.1 score: 6.8
Affected organisations are encouraged to review Ivanti's Security Advisory Ivanti Endpoint Manager (EPM) November 2026 and apply the relevant update.
Definitive source of threat updates
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.
Last edited: 11 November 2026 3:47 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
