# Ivanti Endpoint Manager fixes critical SQL injection

Published: 2026-11-12 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/04766509-3527-545f-b9ad-af9a57a08e27/ivanti-endpoint-manager-fixes-critical-sql-injection
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Ivanti patched a critical unauthenticated SQL injection enabling remote code execution plus a cleartext transmission flaw in Endpoint Manager before 2024 SU8.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0493.html

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL issued an advisory for two vulnerabilities patched by Ivanti in Endpoint Manager, affecting the Core and Agent components. CVE-2026-121653 is a SQL injection flaw in the Core component (versions before 2024 SU8) that allows an unauthenticated remote attacker to inject malicious SQL commands, potentially leading to remote code execution. This vulnerability carries a CVSS v3 score of 9.8, making it critical in severity.

The second vulnerability, CVE-2026-18128, involves the Agent component sending sensitive information in cleartext, also in versions before 2024 SU8. An unauthenticated attacker positioned as a man-in-the-middle could intercept, read, and manipulate HTTP traffic, compromising confidentiality and integrity of communications. This flaw has a CVSS v3 score of 6.8. Ivanti has released updates addressing both issues; defenders running affected versions should prioritize patching, especially given the unauthenticated and remotely exploitable nature of the SQL injection flaw.

No evidence of active exploitation is mentioned in this advisory. Organizations using Ivanti Endpoint Manager should update to 2024 SU8 or later to remediate both vulnerabilities.

## Mentioned in this report

- Vulnerabilities: CVE-2026-121653, CVE-2026-18128

## Detection guidance (public sample)

### SQL Server Process Spawning Command Shell or LOLBin

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects sqlservr.exe spawning a shell or common living-off-the-land binary, the typical xp_cmdshell result of SQL injection escalating to RCE on an Ivanti EPM Core database host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Server Process Spawning Command Shell or LOLBin
description: Detects sqlservr.exe spawning a command interpreter or common LOLBin.
  This is the usual process pattern when SQL injection (for example in an Ivanti Endpoint
  Manager Core database) is escalated to OS command execution via xp_cmdshell or similar.
  The advisory describes no exploitation in the wild, so this is a generic post-exploitation
  detection and not tied to a specific campaign.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \wscript.exe
    - \cscript.exe
    - \whoami.exe
    - \curl.exe
  filter_sqlagent_maintenance:
    CommandLine|contains:
    - SQLAGENT
    - sqlcmd
  condition: selection and not filter_sqlagent_maintenance
falsepositives:
- DBA maintenance or backup jobs that intentionally enable xp_cmdshell to run scripts
- Legacy application installers or ETL jobs that shell out from SQL Server
level: medium
id: ffc1b2f2-6762-5217-bc36-37d876df6e0b
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0493.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0493.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/04766509-3527-545f-b9ad-af9a57a08e27/ivanti-endpoint-manager-fixes-critical-sql-injection.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup