Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login

Ivanti has released November 2026 security updates for Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Application (CSA), and User Workspace Manager (UWM). The flaws expose systems to remote code execution, certificate changes, data theft, and service disruption. Critical EPM and CSA vulnerabilities require immediate attention.

Ivanti said the issues came through responsible disclosure, with no known customer exploitation before publication. However, services reachable without authentication remain urgent patching targets. Endpoint Manager SQL injection vulnerabilities demonstrate the risks facing management infrastructure.

Ivanti SQL Injection Flaw

The most severe flaw, CVE-2026-121653, scores 9.8 and allows remote, unauthenticated attackers to execute code through SQL injection in EPM Core before 2024 SU8. CVE-2026-18128, rated 6.8, exposes sensitive agent information in cleartext, allowing attackers between communicating systems to read or modify HTTP traffic. Both affect EPM 2024 SU7 and earlier; SU8 is available through the Ivanti License System.

CSA’s CVE-2026-121683 scores 9.4. Missing authentication allows remote attackers to add or delete arbitrary trusted EPM Core certificate entries. Only version 5.0.8 is affected; 5.0.7 and earlier are unaffected. The supplied CSA advisory identifies 5.0.8.1 as the fix.

Following Ivanti’s dual network interface guidance limits exposure to the internal interface, preventing external exploitation. Patching remains necessary. These certificate changes differ from earlier CSA authentication and injection flaws .

The EPMM advisory lists six vulnerabilities. CVE-2026-105425, rated 7.2, enables remote administrators to execute code through operating system command injection. It also affects Sentry, requiring separate updates across both products.

CVE-2026-105426 lets remote administrators set Linux kernel parameters as root; CVE-2026-105427 permanently disables Apache HTTPS services. CVE-2026-107404 enables arbitrary file deletion, while CVE-2026-83528 exposes GDPR-protected personal information.

These issues require administrator access. Authenticated local attackers can trigger a denial of service through CVE-2026-107405. Fixed EPMM releases are 12.11.0.0, 12.10.0.1, and 12.9.0.3.

Sentry also fixes CVE-2026-105669, an argument injection flaw that lets remote administrators execute existing disk binaries. CVE-2026-123179 lets local authenticated attackers disrupt service through the Tomcat shutdown listener. CVE-2026-123181 permits remote administrators to create arbitrary files and directories as root. Fixed releases include 11.0.0, 10.8.3, and 10.7.4.

UWM fixes CVE-2026-105813, a medium-severity cleartext storage flaw allowing local authenticated attackers to retrieve another local user’s session. Customers should install UWM 2026.4 through Ivanti’s licensing system.

Security teams should prioritize unauthenticated EPM and CSA exposure, then patch remaining deployments according to access and risk. Earlier EPMM and Sentry updates addressed separate vulnerabilities. Ivanti supplied no vulnerability-specific compromise indicators because public exploitation is unknown. Verify installed versions after updating; restricted administrator access does not replace patches.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection

Torrance, USA, November 11th, 2026, CyberNewswire Criminal IP, the AI-powered threat intelligence and attack surface…

Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites

Fortinet has patched a critical flaw in FortiClient that lets attackers run code on a…

N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers

N-able has warned that attackers are actively scanning for vulnerable N-central servers after the publication…

BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities

"BluePhishing," a technique that extends OAuth consent phishing to Microsoft Entra's AI agent model. The…

Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk

Microsoft disclosed two Windows Active Directory vulnerabilities on November 10, 2026, exposing affected systems to…

Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet

Researchers have mapped 45 open-source frameworks that wire a large language model into a…