Ivanti Endpoint Manager SQL Injection Flaw Enables Remote Code Execution

## Overview Ivanti Endpoint Manager has a critical SQL injection vulnerability, identified as CVE-2026-121653. This flaw affects versions prior to 2024 SU8. It allows remote unauthenticated attackers to execute arbitrary code on affected systems. ## Technical Details The vulnerability resides in the Core of Ivanti Endpoint Manager. An attacker can exploit this SQL injection flaw to send crafted requests to the server. Successful exploitation can lead to full control over the affected system without requiring any form of authentication. The CVSS score for this vulnerability is 9.8, indicating its critical severity. ## Impact If exploited, this vulnerability can have severe consequences for organizations using Ivanti Endpoint Manager. Attackers can gain unauthorized access, potentially leading to data breaches, system compromise, and disruption of services. The risk is particularly high for organizations that have not applied the necessary patches. ## Mitigation Defenders should prioritize updating Ivanti Endpoint Manager to version 2024 SU8 or later. Organizations are advised to verify their current version and apply the security update immediately. Regularly reviewing and patching software vulnerabilities is essential to maintain security posture.