Threat video1:00
CVE-2026-121653 Ivanti EPM SQLi RCE: Detection & IOCs
Ivanti's patched EPM flaw is an unauthenticated SQL injection to RCE, not yet seen exploited; 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-121653 Ivanti EPM SQLi RCE: Detection & IOCs →
Chapters
- 0:00The hookIvanti patched a critical 9.8 flaw.
- 0:04The storyIvanti fixed 13 flaws.
- 0:10Attack pathUnauthenticated SQL injection in EPM allows remote code execution.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to credential access.
- 0:42Remediation3 steps now: Inventory internet-exposed Ivanti EPM, CSA, Sentry and EPMM instances.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ivanti patched a critical 9.8 flaw.
0:05Ivanti fixed 13 flaws.
0:07Ivanti has no evidence of exploitation.
0:11Unauthenticated SQL injection in EPM allows remote code execution.
0:17Missing authentication in CSA lets anyone alter certificate entries.
0:22A medium cleartext flaw is fixed too.
0:27No threat actor is attributed. Confidence: low.
0:31No malicious indicators were published.
0:376 ATT&CK techniques, from initial access to credential access.
0:423 steps now: Inventory internet-exposed Ivanti EPM, CSA, Sentry and EPMM instances.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.