Summary
- CVE-2026-121653 is a critical SQL injection vulnerability in Ivanti Endpoint Manager that could enable unauthenticated remote code execution.
- A second vulnerability, CVE-2026-18128, could allow an attacker positioned between communicating systems to read or modify HTTP traffic.
- Both flaws affect Endpoint Manager versions before 2024 SU8, with NHS England advising affected organisations to update.
Enterprise endpoint management systems face a critical security risk after Ivanti released fixes for vulnerabilities that could allow unauthenticated remote code execution and expose sensitive communications between managed components.
Ivanti has corrected two weaknesses affecting Endpoint Manager (EPM), including CVE-2026-121653, a SQL injection vulnerability assigned a CVSS 3.1 severity score of 9.8.
NHS England’s National Cyber Security Operations Centre issued alert CC-4890 on 11 November, warning that successful exploitation could allow a remote attacker to execute code without authenticating.
The flaw affects Endpoint Manager releases earlier than 2024 SU8. The same update addresses CVE-2026-18128, a cleartext transmission weakness rated 6.8 that could allow an attacker occupying a man-in-the-middle position to read or modify HTTP traffic.
The vulnerabilities have different prerequisites, so they require separate assessment despite being corrected through the same update.
Management infrastructure occupies a privileged position
Endpoint management platforms enable administrators to distribute software, maintain device configurations, manage inventories, and perform operational tasks across extensive computer fleets.
Depending on deployment architecture, a central management server may hold permissions or connections that extend far beyond those available to a standard workstation user.
A weakness affecting such infrastructure can therefore introduce wider exposure than a flaw limited to one application on an individual device.
The present Ivanti advisory identifies potential remote code execution within the affected management core. It does not establish that any particular organisation has experienced a wider compromise or that attackers have used the vulnerability to manage additional endpoints.
SQL injection creates an unauthenticated entry point
SQL injection can arise when application input improperly influences database queries. Its consequences depend on the affected software and privileges available to the relevant service.
For CVE-2026-121653, Ivanti identifies a route to remote code execution without prior authentication under affected conditions. The rating of 9.8 reflects the potentially serious impact when exploitation succeeds.
The absence of an authentication prerequisite is particularly concerning where a vulnerable service is reachable from untrusted networks.
However, the vendor says it was not aware of exploitation of the affected EPM vulnerabilities at the time of the November disclosure. The public advisories establish technical exposure, not a confirmed intrusion campaign.
Administrators therefore need to assess the likelihood of reaching the vulnerable component and the importance of that component within their own environment while applying the available update.
Agent communications present a separate weakness
The second vulnerability, CVE-2026-18128, concerns the transmission of sensitive information in cleartext between affected Endpoint Manager agent components.
Under the necessary conditions, an attacker able to intercept communications could read or modify HTTP traffic. This is different from the unauthenticated SQL injection issue and should not be described as providing the same remote code execution capability.
The risk depends on the communications path, the ability to occupy an interception position, and the sensitivity of information transferred.
Management traffic requires appropriate protection because even routine endpoint operations can involve configuration information and administrative instructions.
Version verification guides remediation
Organisations operating Endpoint Manager should inventory servers and agents, establish installed versions, and review the vendor’s upgrade path to 2024 SU8 or another supported corrected release.
Updates to management infrastructure may require service maintenance windows, particularly if endpoints depend on its availability for routine configuration and software delivery.
Security teams should also review whether management interfaces are accessible from networks where they do not need to be exposed. Such restrictions may reduce risk but cannot replace correcting vulnerabilities in the software itself.
After updates, administrators need to verify that the intended release is running and that management functions and communications remain operational.
NHS England’s official alert and Ivanti’s security advisory provide the affected-version and remediation guidance.
The disclosures reinforce the need to maintain systems that administer other technology assets with particular care, because their legitimate responsibilities give them privileged access within enterprise infrastructure.
