{"id":"EM-20261112-VRAT","url":"https://cyber.eventmonitor.net/incident/EM-20261112-VRAT/critical-core-of-ivanti-endpoint-manager-vulnerability-cve-2026-121653/","type":"cve","title":"Critical Core of Ivanti Endpoint Manager Vulnerability (CVE-2026-121653)","subtitle":"CVE-2026-121653","subject":"CVE-2026-121653","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-12T14:32:09.000Z","firstSignal":"2026-11-10T16:17:17.580Z","lastSignal":"2026-11-12T14:32:09.000Z","updated":"2026-11-12T15:50:47.989Z","revision":2,"life":[{"status":"Born","at":"2026-11-12T14:32:09.000Z","why":"second independent source: C15 NCSC-NL"},{"status":"Developing","at":"2026-11-12T14:32:09.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T16:17:17.580Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T06:43:56.000Z","what":"Source joined: C31 Vulners (new public exploits)"},{"at":"2026-11-12T14:32:09.000Z","what":"Born: second source, C15 NCSC-NL. Page EM-20261112-VRAT created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T16:17:17.580Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T16:17:17.580Z","detail":"CVSS 9.8 · EPSS 2.0%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-12T14:32:09.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T16:17:17.580Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-121653 (CVSS 9.8)","text":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121653"},{"at":"2026-11-12T06:43:56.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-121653","text":"# CVE-2026-121653 — Ivanti Endpoint Manager Core unauthenticated SQL injection → RCE\n\n| | |\n|---|---|\n| **CVE** | CVE-2026-121653 |\n| **Component** | Ivanti Endpoint Manager (EPM) — **Core** server, status-event web service (`PatchBiz.dll` → `RecordGoodApp`, published for the same defect class in…","url":"https://github.com/googlesky/CVE-2026-121653"},{"at":"2026-11-12T14:32:09.000Z","source":"C15","sourceName":"NCSC-NL","role":"Government","severity":2,"title":"NCSC-2026-0493 [1.00] [M/H] Kwetsbaarheden verholpen in Ivanti Endpoint Manager","text":"Ivanti heeft twee kwetsbaarheden in Ivanti Endpoint Manager verholpen, die betrekking hebben op de Core- en Agent-componenten. De eerste kwetsbaarheid (CVE-2026-121653) betreft een SQL-injectie in de Core van Ivanti Endpoint Manager-versies vóór 2024 SU8. Hierdoor kan een externe, niet-geauthenticeerde aanvaller kwaadaardige SQL-commando's injecteren, wat kan leiden tot het uitvoeren van…","url":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0493"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T16:17:17.580","score":9.8,"severity":"CRITICAL","desc":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.","product":"","seen":1794404383637},"kev":null,"epss":{"epss":0.0198,"pct":0.80837,"at":1794498647989},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}