CVE-2026-121653 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-121653 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-121653 is a critical SQL injection flaw in the core of Ivanti Endpoint Manager affecting versions before 2024 SU8. A remote, unauthenticated attacker can exploit the issue to achieve remote code execution (RCE), which means full takeover of the management server and potential access to connected endpoints. Although there is no known exploitation in the wild and it is not currently in CISA KEV, the severity is extremely high and the attack path is simple enough that small teams should treat this as an urgent patching event.

Immediate Action

  • Patch immediately to Ivanti Endpoint Manager 2024 SU8 or later. If you cannot patch today, isolate the server from the internet and restrict access to trusted admin networks only.
  • Disable or block external exposure of the management interface at the firewall, reverse proxy, or VPN gateway until remediation is complete.
  • Review vendor guidance and apply any hotfixes or post-SU8 security updates published by Ivanti. Ivanti security advisory
  • Take a backup/snapshot before upgrading so you can roll back if the patch breaks integrations, but do not roll back to a vulnerable build after exposure.
  • Assume compromise if exposed to the public internet for any period. Check logs for unusual requests, new admin accounts, unexpected service changes, and outbound connections.

Affected Versions

  • Ivanti Endpoint Manager < 2024 SU8 vulnerable; upgrade to 2024 SU8 or later.
  • Ivanti Endpoint Manager 2024 SU8+ expected safe based on current advisory details.
  • TODO: any earlier supported branches vulnerable if still in use; apply the vendor’s fixed release for that branch if provided.
  • TODO: appliance / on-prem deployment variants may also be affected if they include the core component.

Resolution Guide

This issue is not a dependency you can fix with npm, pip, Maven, or apt/yum. It is a product-level vulnerability in Ivanti Endpoint Manager, so the remediation is to upgrade the application itself and harden exposure while you do it.

# Windows / on-prem admin workflow
# 1) Confirm current version in the UI or installed build info
# 2) Download and install Ivanti Endpoint Manager 2024 SU8 or later
# 3) Restart services after upgrade
# TODO: replace with your environment's exact service names
Restart-Service "Ivanti Endpoint Manager Service"

# If the server is internet-facing, temporarily restrict access
# Example: allow only your admin VPN or office IPs
# TODO: replace with your firewall platform
iptables -A INPUT -p tcp --dport 443 -s YOUR_ADMIN_IP/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Docker / containerized deployment: update to a fixed image tag
docker pull ivanti/endpoint-manager:2024-su8
docker stop endpoint-manager
docker rm endpoint-manager
docker run -d --name endpoint-manager ivanti/endpoint-manager:2024-su8

Hardening examples:

# Disable public exposure until patched
# TODO: exact feature flag or config key depends on deployment
EXPOSE_WEB_UI=false
ALLOW_REMOTE_ADMIN=false

Minimal code-fix pattern for teams writing adjacent tooling or integrations: always use parameterized queries, never string concatenation.

// BAD
const sql = "SELECT * FROM users WHERE name = '" + userInput + "'";

// GOOD
const sql = "SELECT * FROM users WHERE name = ?";
db.query(sql, [userInput]);

Detection & Verification

Check whether you are vulnerable:

  • Open the product’s version/about page and confirm whether it is before 2024 SU8.
  • Search installed files, release notes, or package metadata for the build number.
  • Look for internet exposure of the admin interface and any reverse proxy rules that expose it publicly.
  • Review logs for unusual POSTs, SQL error messages, unexpected authentication attempts, or spikes in requests to management endpoints.
# Example local checks
# Windows PowerShell
Get-ChildItem "C:\Program Files" -Recurse | Select-String -Pattern "2024 SU8|Ivanti Endpoint Manager"

# Linux-style grep if applicable in your environment
grep -RniE "2024 SU8|Ivanti Endpoint Manager" /opt /etc 2>/dev/null

Verify the fix:

# Confirm the upgraded version in the product UI or release info
# TODO: replace with exact vendor CLI/API if available
curl -k https://YOUR-SERVER.example.com/health
curl -k https://YOUR-SERVER.example.com/version

# Confirm the service is no longer publicly reachable
nmap -Pn -p 443 YOUR_PUBLIC_IP
# Expect: filtered/closed or only reachable from trusted admin networks

Risk and Impact

If exploited, this vulnerability can give an attacker full control of the Endpoint Manager server without credentials. From there, they may steal sensitive device inventory, push malicious software, modify management policies, or pivot into the broader internal network. For small teams, the blast radius can be especially severe because a single management server often has authority over many endpoints and privileged credentials.

Bottom line: treat this as a same-day patch and exposure-reduction event. If the server was reachable from the internet, prioritize incident review even if you have not seen obvious signs of compromise.

Keep reading