Ivanti has patched a critical security flaw in its Endpoint Manager software that could let an attacker run code on a company's management server without logging in. The flaw, tracked as CVE-2026-121653, carries a CVSS severity score of 9.8 out of 10 and was fixed as part of Ivanti's November 2026 security update, published on Tuesday, 10 November 2026.

The vulnerability is a SQL injection flaw in the Endpoint Manager Core. In plain terms, a remote attacker could send a crafted request to a vulnerable server and trick its database into running commands of the attacker's choosing, leading to full remote code execution. No username or password is needed. Ivanti says the flaw affects Endpoint Manager versions before 2024 SU8 and is fixed by updating to that release.

Thirteen flaws across five products

The November update covers five Ivanti products: Endpoint Manager, Endpoint Manager Mobile, Sentry, Cloud Services Appliance and User Workspace Manager. Across five security advisories, Ivanti fixed 13 vulnerabilities in total, two of them rated critical, one high and ten medium. As well as the Endpoint Manager flaw, the release fixes a second Endpoint Manager issue, CVE-2026-18128, rated 6.8.

Ivanti said it was not aware of any customers being exploited through these vulnerabilities at the time of disclosure, and none of the 13 flaws appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. The flaws were reported through Ivanti's responsible disclosure programme, and Ivanti has not published indicators of compromise because no public exploitation is known.

What administrators should do

Organisations running Endpoint Manager should update to 2024 SU8, and Cloud Services Appliance users should move to version 5.0.8.1. Ivanti releases standard security patches on the second Tuesday of every month, and the November batch follows a difficult year for the company, whose Connect Secure and Endpoint Manager Mobile products have both faced actively exploited flaws in 2026.

Endpoint Manager is used by IT teams to manage fleets of desktop and laptop computers, so a vulnerable server can be a gateway to every machine it controls. The absence of known exploitation is reassuring, but the history of Ivanti flaws being picked up quickly by attackers means administrators should not wait. The update also covers the mobile, Sentry, cloud services and workspace products named in the advisories, so teams should apply every patch in the batch rather than cherry-picking the Endpoint Manager fix alone. Patching the management server matters more than patching the endpoints it looks after, because that server holds the keys to the whole estate. Source links: Ivanti and Cybersecurity News.