CVE-2026-121653
Critical9.8SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- CVSS
- 9.8v3.1
- EPSS (exploit probability)
- Unavailable
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Unavailable
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Learn
Why it happened and what stops it
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 8 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 8 of these techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 of these techniques
- AC-2Account ManagementAccess Control · mitigates 6 of these techniques
- AC-3Access EnforcementAccess Control · mitigates 6 of these techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 6 of these techniques
Coverage1 article
SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
Podcast6 minSANS Internet Storm Center StormCastjust nowVulnerabilitiesEndpointAppSecCVE-2026-119618CVE-2026-121653