Skip to content
SQL Injection Vulnerability in Ivanti Products Disclosed

SQL Injection Vulnerability in Ivanti Products Disclosed

First seen 14 Nov 2026, 04:17 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 04:17 UTC
  • •CVE-2026-121653 is rated critical with a CVSS of 9.8 and has a public PoC available.
  • •CVE-2026-18128 has a medium severity rating of 6.8 but lacks confirmed exploitation.
  • •Immediate patching is recommended for affected Ivanti products to mitigate risks.

A SQL injection vulnerability, CVE-2026-121653, was disclosed in Ivanti products on November 10, 2026, with a CVSS score of 9.8. The first public proof of concept (PoC) was released on November 12, indicating the potential for. This vulnerability affects Ivanti's software, allowing attackers to execute arbitrary SQL commands through improperly sanitized inputs. Additionally, another vulnerability, CVE-2026-18128, was also disclosed on the same day with a lower severity score of 6.8. Currently, there is no confirmation of for CVE-2026-18128. Security professionals are urged to prioritize patching for CVE-2026-121653 due to its nature and the availability of a PoC. The situation remains fluid as further developments may arise.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 20h ago How this analysis works

Timeline

2026-11-10
CVE-2026-121653 published
Ivanti disclosed a critical SQL injection vulnerability with a CVSS score of 9.8.
vulnerability.circl.lu
2026-11-10
CVE-2026-18128 published
A medium severity vulnerability was disclosed alongside CVE-2026-121653, rated 6.8.
vulnerability.circl.lu
2026-11-12
First public PoC for CVE-2026-121653
A proof of concept demonstrating the SQL injection vulnerability was made public.
vulnerability.circl.lu

More articles in this cluster (2)

Following this threat?

Track CVE-2026-121653 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

What is the impact of CVE-2026-121653?
CVE-2026-121653 allows attackers to execute arbitrary SQL commands, posing a significant risk to affected Ivanti products.
Are there any patches available?
Yes, Ivanti has released patches for CVE-2026-121653, and users are advised to apply them immediately.
Is CVE-2026-18128 being exploited?
Currently, there is no confirmation of active exploitation for CVE-2026-18128.