Ivanti Endpoint Manager fixes critical SQL injection
Ivanti patched a critical unauthenticated SQL injection enabling remote code execution plus a cleartext transmission flaw in Endpoint Manager before 2024 SU8.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL issued an advisory for two vulnerabilities patched by Ivanti in Endpoint Manager, affecting the Core and Agent components. CVE-2026-121653 is a SQL injection flaw in the Core component (versions before 2024 SU8) that allows an unauthenticated remote attacker to inject malicious SQL commands, potentially leading to remote code execution. This vulnerability carries a CVSS v3 score of 9.8, making it critical in severity.
The second vulnerability, CVE-2026-18128, involves the Agent component sending sensitive information in cleartext, also in versions before 2024 SU8. An unauthenticated attacker positioned as a man-in-the-middle could intercept, read, and manipulate HTTP traffic, compromising confidentiality and integrity of communications. This flaw has a CVSS v3 score of 6.8. Ivanti has released updates addressing both issues; defenders running affected versions should prioritize patching, especially given the unauthenticated and remotely exploitable nature of the SQL injection flaw.
No evidence of active exploitation is mentioned in this advisory. Organizations using Ivanti Endpoint Manager should update to 2024 SU8 or later to remediate both vulnerabilities.
Mentioned in this report
Detection guidance
SQL Server Process Spawning Command Shell or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects sqlservr.exe spawning a shell or common living-off-the-land binary, the typical xp_cmdshell result of SQL injection escalating to RCE on an Ivanti EPM Core database host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Process Spawning Command Shell or LOLBin
description: Detects sqlservr.exe spawning a command interpreter or common LOLBin.
This is the usual process pattern when SQL injection (for example in an Ivanti Endpoint
Manager Core database) is escalated to OS command execution via xp_cmdshell or similar.
The advisory describes no exploitation in the wild, so this is a generic post-exploitation
detection and not tied to a specific campaign.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sqlservr.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \wscript.exe
- \cscript.exe
- \whoami.exe
- \curl.exe
filter_sqlagent_maintenance:
CommandLine|contains:
- SQLAGENT
- sqlcmd
condition: selection and not filter_sqlagent_maintenance
falsepositives:
- DBA maintenance or backup jobs that intentionally enable xp_cmdshell to run scripts
- Legacy application installers or ETL jobs that shell out from SQL Server
level: medium
id: ffc1b2f2-6762-5217-bc36-37d876df6e0b
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0493.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0493.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs