Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6090 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ivanti EPM Agent Cleartext HTTP Communication Exposed to Adversary-in-the-Middle (CVE-2026-18128)

Detects Ivanti EPM agent processes (vulscan, ldiscn32, softmon, residentagent) making outbound connections to TCP port 80 and reports how many distinct destinations each host talks to. CVE-2026-18128 (CVSS 6.8, CWE-319) exposes sensitive agent information in cleartext so a network-positioned attacker can read or modify agent HTTP traffic (adversary-in-the-middle, transmitted-data manipulation, exposure of credentials in transit). Cleartext agent channels and agents that suddenly reach several HTTP destinations are exposure and relay indicators (TL-2026-6090). Fixed in EPM 2024 SU8.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1557, T1565.002, T1552
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 3), microsoft_defender_for_endpoint (DeviceNetworkEvents)
• Severity: medium
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true DestinationPort=80 (Image="*\\vulscan.exe" OR Image="*\\ldiscn32.exe" OR Image="*\\softmon.exe" OR Image="*\\residentagent.exe") earliest=-24h
| stats count AS connections dc(DestinationIp) AS distinct_destinations values(DestinationIp) AS destinations values(Image) AS agent_processes min(_time) AS first_seen max(_time) AS last_seen BY host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - distinct_destinations - connections

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ ("vulscan.exe", "ldiscn32.exe", "softmon.exe", "residentagent.exe")
| where RemotePort == 80
| summarize Connections = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName
| order by DistinctDestinations desc, Connections desc

Sigma

title: Ivanti EPM Agent Cleartext HTTP Connection on Port 80
id: a2d5f8c3-6e1b-4d79-8f40-3c7e9b2a1d07
status: experimental
description: Detects Ivanti EPM agent processes connecting outbound over cleartext HTTP (TCP 80), exposing agent traffic to read or modification by an adversary-in-the-middle as described in CVE-2026-18128 (TL-2026-6090).
references:
  - https://gbhackers.com/ivanti-patches-critical-sql-injection-flaw/
  - https://securityonline.info/ivanti-security-advisories-november-2026/
  - https://digital.nhs.uk/cyber-alerts/2026/cc-4890
author: Threadlinqs Team
date: 2026/11/14
tags:
  - attack.credential-access
  - attack.t1557
  - attack.t1552
  - attack.impact
  - attack.t1565.002
  - cve.2026.18128
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 80
    Image|endswith:
      - '\vulscan.exe'
      - '\ldiscn32.exe'
      - '\softmon.exe'
      - '\residentagent.exe'
  condition: selection
falsepositives:
  - Agents deliberately configured for HTTP communication with the core server on an isolated network
  - Core server selection or bootstrap traffic during agent deployment
level: medium

Known false positives:

• Agents deliberately configured for HTTP communication with the core on a trusted isolated segment
• Agent bootstrap or core-selection traffic during initial deployment

Tuning notes: Baseline legitimate EPM core IPs and alert when distinct_destinations is greater than your normal value, which can indicate relay or redirection. Verify agent executable names against your EPM agent version. Pair with network telemetry (ARP/DHCP anomalies, Zeek HTTP logs) on agent VLANs. Patching to EPM 2024 SU8 and enforcing HTTPS is the remediation; this rule measures exposure and anomalies.

• 🔒 Ivanti CSA Unauthenticated Trusted-Certificate Add/Delete Requests (CVE-2026-121683) — Exploitation · unlock with TL Creds
• 🔒 MSSQL xp_cmdshell or Ole Automation Enabled on Ivanti EPM Core Database Server (CVE-2026-121653) · unlock with TL Creds
• 🔒 Ivanti Management-Plane Service Making Outbound Connection to Public Destination — Callback After RCE (CVE-2026-121653) · unlock with TL Creds
• 🔒 Ivanti EPMM/Sentry Tomcat Java Process Spawning Shell or Download Utility (CVE-2026-105425, CVE-2026-105669) — Exploitation · unlock with TL Creds
• 🔒 Ivanti EPMM/Sentry Java Process Changing Kernel Parameters or Writing Root Persistence Paths (CVE-2026-105426, CVE-2026-123181) · unlock with TL Creds
• 🔒 Ivanti EPMM/Sentry Web Service Stop or Tomcat Shutdown-Listener Abuse (CVE-2026-105427, CVE-2026-123179) · unlock with TL Creds
• 🔒 Ivanti EPM Core SQL Injection Probing Against Management Web Endpoints (CVE-2026-121653) — Exploitation · unlock with TL Creds
• 🔒 Ivanti EPM Core IIS or SQL Server Process Spawning Command Interpreter — Post-SQLi RCE (CVE-2026-121653) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-6090.

Technical analysis

Ivanti reports no evidence of exploitation in the wild, and none of the CVEs were in CISA KEV as of November 11, 2026.

On November 10, 2026 Ivanti published five security advisories covering 13 CVEs in Endpoint Manager (EPM), the Cloud Services Application (CSA), Endpoint Manager Mobile (EPMM), Ivanti Sentry and User Workspace Manager (UWM). The issues were reported through Ivanti's responsible disclosure program.

The most severe issue, CVE-2026-121653 (CVSS 3.1 9.8, CWE-89), is a SQL injection in the Core of Ivanti Endpoint Manager that lets a remote, unauthenticated attacker achieve remote code execution. EPM 2024 SU7 and earlier are affected; EPM 2024 SU8 fixes it. A companion EPM flaw, CVE-2026-18128 (CVSS 6.8, CWE-319), is a cleartext exposure of sensitive agent information: an attacker positioned between communicating systems can read or modify agent HTTP traffic. It is also fixed in 2024 SU8.

CVE-2026-121683 (CVSS 9.4, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, CWE-306) is a missing-authentication flaw in the Cloud Services Application that lets a remote unauthenticated attacker add and delete trusted EPM Core certificate entries. Only CSA 5.0.8 is affected (5.0.7 and earlier are not) and the fix is 5.0.8.1. Sources note a record discrepancy: the CVE.org record encodes 5.0.8 as unaffected and one table lists 5.0.8 as the fixed version, while the advisory text says 5.0.8.1; defenders should confirm against Ivanti's CSA advisory. Under Ivanti's documented Dual NIC best practice, exposure is limited to the internal interface; this does not replace patching.

The EPMM, Sentry and UWM issues mostly require administrator or local authenticated access. CVE-2026-105425 (CVSS 7.2, CWE-78) is an OS command injection exploitable by remote administrators and affects both EPMM and Sentry (credited to btaol of Aquila Sec Lab). Other EPMM issues: Linux kernel parameters set as root by remote administrators (CVE-2026-105426, CVSS 6.7, CWE-20), permanent disabling of Apache HTTPS services (CVE-2026-105427), arbitrary file deletion (CVE-2026-107404), exposure of GDPR-protected personal information (CVE-2026-83528) and denial of service by authenticated local attackers (CVE-2026-107405, CVSS 5.5, CWE-749). Sentry issues: argument injection letting remote administrators run existing on-disk binaries (CVE-2026-105669, CVSS 6.7, CWE-88), Tomcat shutdown-listener service disruption by local authenticated attackers (CVE-2026-123179) and arbitrary file/directory creation as root by remote administrators (CVE-2026-123181). UWM Neurons Hybrid CVE-2026-105813 (CVSS 6.3, CWE-312) lets a local authenticated user retrieve another local user's session.

No public proof-of-concept, vulnerability-specific indicators of compromise or attribution have been published. CISA-ADP's SSVC entry for CVE-2026-121653 (added November 11, 2026) sets Exploitation to none. Because EPM, EPMM and Sentry are high-value management-plane systems, defenders should patch promptly and prioritize internet-reachable EPM and CSA deployments. Note that the NVD records were still in 'Received' status when reviewed, so scores and affected ranges for the lesser CVEs may change.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle; T1649 Steal or Forge Authentication Certificates

defense-impairment

T1553.004 Subvert Trust Controls: Install Root Certificate

Impact

T1565.002 Transmitted Data Manipulation

Remediation

Patches

• EPM 2024 SU8
• CSA 5.0.8.1
• EPMM 12.11.0.0, 12.10.0.1 or 12.9.0.3
• Sentry 11.0.0, 10.8.3 or 10.7.4
• UWM 2026.4

Immediate actions

• Upgrade Ivanti EPM to 2024 SU8 (fixes CVE-2026-121653 and CVE-2026-18128)
• Upgrade Ivanti CSA 5.0.8 to 5.0.8.1 (CVE-2026-121683) and confirm the fixed version against Ivanti's CSA advisory
• Prioritize internet-reachable EPM Core and CSA instances first, then remaining deployments by access level and risk

Workarounds

• No workarounds listed for EPM, EPMM, Sentry or UWM; Dual NIC configuration limits CSA exposure but does not replace upgrading

Longer-term hardening

• Follow Ivanti's Dual NIC best practice so CSA exposure is limited to the internal interface
• Restrict and audit administrator access to EPMM and Sentry; this does not replace patching
• Verify installed versions against asset inventory after updating

Affected and fixed versions

• Ivanti — Endpoint Manager (EPM) Core
  Vulnerable versions: 2024 SU7 and earlier
  Fixed in: 2024 SU8
• Ivanti — Cloud Services Application (CSA)
  Vulnerable versions: 5.0.8
  Fixed in: 5.0.8.1
• Ivanti — Endpoint Manager Mobile (EPMM)
  Vulnerable versions: 12.10.0.0 and earlier; 12.9.0.2 and earlier
  Fixed in: 12.11.0.0; 12.10.0.1; 12.9.0.3
• Ivanti — Sentry
  Vulnerable versions: 10.8.2 and earlier; 10.7.3 and earlier
  Fixed in: 11.0.0; 10.8.3; 10.7.4
• Ivanti — User Workspace Manager (UWM, Neurons Hybrid only)
  Vulnerable versions: 2026.2 and earlier
  Fixed in: 2026.4

Timeline

• 2026-11-10 Fixed releases made available: EPM 2024 SU8, CSA 5.0.8.1, EPMM 12.11.0.0/12.10.0.1/12.9.0.3, Sentry 11.0.0/10.8.3/10.7.4, UWM 2026.4. Ivanti states it has no evidence of in-the-wild exploitation.
• 2026-11-10 Ivanti publishes five security advisories fixing 13 vulnerabilities across EPM, CSA, EPMM, Sentry and UWM, including EPM Core SQL injection CVE-2026-121653 (CVSS 9.8) and CSA CVE-2026-121683 (CVSS 9.4).
• 2026-11-11 GBHackers, Daily Security Review and an NHS England cyber alert (CC-4890) report on the Ivanti fixes and urge patching.
• 2026-11-11 NVD records for the Ivanti CVEs are in 'Received' status; NVD and CVE.org disagree on the CSA 5.0.8 affected status and EPMM affected ranges.
• 2026-11-11 Rescana's check against CISA KEV catalogVersion 2026.11.10 finds neither CVE-2026-121653 nor CVE-2026-121683 listed.
• 2026-11-11 CISA-ADP adds an SSVC entry for CVE-2026-121653 with Exploitation set to 'none'.

Sources cited

• NHS England Cyber Alert CC-4890 - Ivanti vulnerabilities digital.nhs.uk · Advisory · 2026-11-11
• Ivanti EPM/CSA CVE-2026-121653 / CVE-2026-121683 - Patch Now (Rescana) rescana.com · Research · 2026-11-11
• Ivanti November 2026 Security Updates: 13 Vulnerabilities Disclosed (SmartScope) smartscope.blog · Blog · 2026-11-11
• Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login gbhackers.com · News · 2026-11-11
• Ivanti Security Advisories November 2026 (SecurityOnline) securityonline.info · News · 2026-11-10
• Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw (Daily Security Review) dailysecurityreview.com · News · 2026-11-11
• CVE-2026-121653 (The Hacker Wire) thehackerwire.com · News · 2026-11-11

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)
• CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV

Related coverage of this activity

• Ivanti EPM SQLi RCE

Further reading

• Ivanti EPMM RCE: CVE-2026-1281, CVE-2026-1340