CISAAnalysisCISA adds Ivanti Endpoint Manager unauthenticated SQL injection flaw to KEV catalog
What happened.CISA ordered federal civilian agencies to patch a critical unauthenticated SQL injection vulnerability in Ivanti Endpoint Manager core servers.
Why it matters.Endpoint management servers centralize software distribution, system inventory, and administrative credentials across enterprise networks. When SQL injection defects grant unauthenticated remote code execution on core controllers, intruders compromise internal domain assets. Infrastructure administrators must update Ivanti Endpoint Manager to version 2024 SU8 immediately. Organizations should restrict administrative console access to dedicated internal networks.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-121653 with a 9.8 CVSS score, the defect stems from improper input neutralization in Ivanti Endpoint Manager Core.
- Exploitation path: Remote unauthenticated attackers send crafted SQL commands over the network, achieving arbitrary code execution on the underlying management server.
- Affected versions: The vulnerability impacts Ivanti Endpoint Manager Core version 2024 SU7 and all prior releases.
- Related bulletin: Ivanti also addressed CVE-2026-121683, a 9.4 CVSS missing authentication flaw in its Cloud Services Application appliance.
- Remediation release: Ivanti published Endpoint Manager version 2024 SU8, advising administrators to apply updates through the Ivanti License System.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: