# Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws

> Ivanti's November 10, 2026 security updates fix 13 vulnerabilities across five products, led by a CVSS 9.8 SQL injection in Endpoint Manager (EPM) Core (CVE-2026-121653) that allows unauthenticated remote code execution and a CVSS 9.4 missing-authentication flaw in the Cloud Services Application (CVE-2026-121683). Ivanti reports no evidence of exploitation in the wild, and none of the CVEs were in CISA KEV as of November 11, 2026.

- **Published:** 2026-11-14T14:52:29Z
- **Last reviewed:** 2026-11-14T14:52:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6090
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6090.png
- **ID:** TL-2026-6090
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-121653, CVE-2026-18128, CVE-2026-121683, CVE-2026-105425, CVE-2026-105426, CVE-2026-105427, CVE-2026-107404, CVE-2026-83528, CVE-2026-107405, CVE-2026-105669, CVE-2026-123179, CVE-2026-123181, CVE-2026-105813

## Description

On November 10, 2026 Ivanti published five security advisories covering 13 CVEs in Endpoint Manager (EPM), the Cloud Services Application (CSA), Endpoint Manager Mobile (EPMM), Ivanti Sentry and User Workspace Manager (UWM). The issues were reported through Ivanti's responsible disclosure program.

The most severe issue, CVE-2026-121653 (CVSS 3.1 9.8, CWE-89), is a SQL injection in the Core of Ivanti Endpoint Manager that lets a remote, unauthenticated attacker achieve remote code execution. EPM 2024 SU7 and earlier are affected; EPM 2024 SU8 fixes it. A companion EPM flaw, CVE-2026-18128 (CVSS 6.8, CWE-319), is a cleartext exposure of sensitive agent information: an attacker positioned between communicating systems can read or modify agent HTTP traffic. It is also fixed in 2024 SU8.

CVE-2026-121683 (CVSS 9.4, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, CWE-306) is a missing-authentication flaw in the Cloud Services Application that lets a remote unauthenticated attacker add and delete trusted EPM Core certificate entries. Only CSA 5.0.8 is affected (5.0.7 and earlier are not) and the fix is 5.0.8.1. Sources note a record discrepancy: the CVE.org record encodes 5.0.8 as unaffected and one table lists 5.0.8 as the fixed version, while the advisory text says 5.0.8.1; defenders should confirm against Ivanti's CSA advisory. Under Ivanti's documented Dual NIC best practice, exposure is limited to the internal interface; this does not replace patching.

The EPMM, Sentry and UWM issues mostly require administrator or local authenticated access. CVE-2026-105425 (CVSS 7.2, CWE-78) is an OS command injection exploitable by remote administrators and affects both EPMM and Sentry (credited to btaol of Aquila Sec Lab). Other EPMM issues: Linux kernel parameters set as root by remote administrators (CVE-2026-105426, CVSS 6.7, CWE-20), permanent disabling of Apache HTTPS services (CVE-2026-105427), arbitrary file deletion (CVE-2026-107404), exposure of GDPR-protected personal information (CVE-2026-83528) and denial of service by authenticated local attackers (CVE-2026-107405, CVSS 5.5, CWE-749). Sentry issues: argument injection letting remote administrators run existing on-disk binaries (CVE-2026-105669, CVSS 6.7, CWE-88), Tomcat shutdown-listener service disruption by local authenticated attackers (CVE-2026-123179) and arbitrary file/directory creation as root by remote administrators (CVE-2026-123181). UWM Neurons Hybrid CVE-2026-105813 (CVSS 6.3, CWE-312) lets a local authenticated user retrieve another local user's session.

No public proof-of-concept, vulnerability-specific indicators of compromise or attribution have been published. CISA-ADP's SSVC entry for CVE-2026-121653 (added November 11, 2026) sets Exploitation to none. Because EPM, EPMM and Sentry are high-value management-plane systems, defenders should patch promptly and prioritize internet-reachable EPM and CSA deployments. Note that the NVD records were still in 'Received' status when reviewed, so scores and affected ranges for the lesser CVEs may change.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1553.004 Subvert Trust Controls: Install Root Certificate
- T1649 Steal or Forge Authentication Certificates
- T1557 Adversary-in-the-Middle
- T1552 Unsecured Credentials
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ivanti EPM Agent Cleartext HTTP Communication Exposed to Adversary-in-the-Middle (CVE-2026-18128)** (`TL-2026-6090-SPL-003`)

Detects Ivanti EPM agent processes (vulscan, ldiscn32, softmon, residentagent) making outbound connections to TCP port 80 and reports how many distinct destinations each host talks to. CVE-2026-18128 (CVSS 6.8, CWE-319) exposes sensitive agent information in cleartext so a network-positioned attacker can read or modify agent HTTP traffic (adversary-in-the-middle, transmitted-data manipulation, exposure of credentials in transit). Cleartext agent channels and agents that suddenly reach several HTTP destinations are exposure and relay indicators (TL-2026-6090). Fixed in EPM 2024 SU8.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1565.002, T1552
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 3), microsoft_defender_for_endpoint (DeviceNetworkEvents)
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true DestinationPort=80 (Image="*\\vulscan.exe" OR Image="*\\ldiscn32.exe" OR Image="*\\softmon.exe" OR Image="*\\residentagent.exe") earliest=-24h
| stats count AS connections dc(DestinationIp) AS distinct_destinations values(DestinationIp) AS destinations values(Image) AS agent_processes min(_time) AS first_seen max(_time) AS last_seen BY host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - distinct_destinations - connections
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ ("vulscan.exe", "ldiscn32.exe", "softmon.exe", "residentagent.exe")
| where RemotePort == 80
| summarize Connections = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName
| order by DistinctDestinations desc, Connections desc
```

### Sigma

```yaml
title: Ivanti EPM Agent Cleartext HTTP Connection on Port 80
id: a2d5f8c3-6e1b-4d79-8f40-3c7e9b2a1d07
status: experimental
description: Detects Ivanti EPM agent processes connecting outbound over cleartext HTTP (TCP 80), exposing agent traffic to read or modification by an adversary-in-the-middle as described in CVE-2026-18128 (TL-2026-6090).
references:
  - https://gbhackers.com/ivanti-patches-critical-sql-injection-flaw/
  - https://securityonline.info/ivanti-security-advisories-november-2026/
  - https://digital.nhs.uk/cyber-alerts/2026/cc-4890
author: Threadlinqs Team
date: 2026/11/14
tags:
  - attack.credential-access
  - attack.t1557
  - attack.t1552
  - attack.impact
  - attack.t1565.002
  - cve.2026.18128
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 80
    Image|endswith:
      - '\vulscan.exe'
      - '\ldiscn32.exe'
      - '\softmon.exe'
      - '\residentagent.exe'
  condition: selection
falsepositives:
  - Agents deliberately configured for HTTP communication with the core server on an isolated network
  - Core server selection or bootstrap traffic during agent deployment
level: medium

```

**Known false positives:**

- Agents deliberately configured for HTTP communication with the core on a trusted isolated segment
- Agent bootstrap or core-selection traffic during initial deployment

**Tuning notes:** Baseline legitimate EPM core IPs and alert when distinct_destinations is greater than your normal value, which can indicate relay or redirection. Verify agent executable names against your EPM agent version. Pair with network telemetry (ARP/DHCP anomalies, Zeek HTTP logs) on agent VLANs. Patching to EPM 2024 SU8 and enforcing HTTPS is the remediation; this rule measures exposure and anomalies.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ivanti CSA Unauthenticated Trusted-Certificate Add/Delete Requests (CVE-2026-121683) — Exploitation (locked: unlock with TL Creds)
- MSSQL xp_cmdshell or Ole Automation Enabled on Ivanti EPM Core Database Server (CVE-2026-121653) (locked: unlock with TL Creds)
- Ivanti Management-Plane Service Making Outbound Connection to Public Destination — Callback After RCE (CVE-2026-121653) (locked: unlock with TL Creds)
- Ivanti EPMM/Sentry Tomcat Java Process Spawning Shell or Download Utility (CVE-2026-105425, CVE-2026-105669) — Exploitation (locked: unlock with TL Creds)
- Ivanti EPMM/Sentry Java Process Changing Kernel Parameters or Writing Root Persistence Paths (CVE-2026-105426, CVE-2026-123181) (locked: unlock with TL Creds)
- Ivanti EPMM/Sentry Web Service Stop or Tomcat Shutdown-Listener Abuse (CVE-2026-105427, CVE-2026-123179) (locked: unlock with TL Creds)
- Ivanti EPM Core SQL Injection Probing Against Management Web Endpoints (CVE-2026-121653) — Exploitation (locked: unlock with TL Creds)
- Ivanti EPM Core IIS or SQL Server Process Spawning Command Interpreter — Post-SQLi RCE (CVE-2026-121653) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login](https://gbhackers.com/ivanti-patches-critical-sql-injection-flaw/)
- [Ivanti Security Advisories November 2026 (SecurityOnline)](https://securityonline.info/ivanti-security-advisories-november-2026/)
- [Ivanti EPM/CSA CVE-2026-121653 / CVE-2026-121683 - Patch Now (Rescana)](https://www.rescana.com/post/ivanti-epm-csa-cve-2026-121653-121683-patch-now)
- [Ivanti November 2026 Security Updates: 13 Vulnerabilities Disclosed (SmartScope)](https://smartscope.blog/en/blog/ivanti-november-2026-security-updates-13-vulnerabilities-disclosed-2026/)
- [Ivanti Patches Critical EPM SQL Injection and CSA Auth Flaw (Daily Security Review)](https://dailysecurityreview.com/?p=45636)
- [NHS England Cyber Alert CC-4890 - Ivanti vulnerabilities](https://digital.nhs.uk/cyber-alerts/2026/cc-4890)
- [CVE-2026-121653 (The Hacker Wire)](https://www.thehackerwire.com/vulnerability/CVE-2026-121653/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6090