Threat video1:00
Ivanti EPM Core SQLi, 13 Flaws Patched: Detection & IOCs
Ivanti patches 13 flaws, led by unauthenticated SQL injection CVE-2026-121653 in EPM Core. It ships 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Ivanti EPM Core SQLi →
Chapters
- 0:00The hookIvanti fixed a 9.8 critical flaw.
- 0:04The storyFive advisories fixed 13 flaws.
- 0:11Attack pathSQL injection allows unauthenticated remote code execution.
- 0:30AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to impact.
- 0:44Remediation3 steps now: Upgrade Ivanti EPM to 2024 SU8.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ivanti fixed a 9.8 critical flaw.
0:05Five advisories fixed 13 flaws.
0:07Ivanti reports no exploitation in the wild.
0:11SQL injection allows unauthenticated remote code execution.
0:16A companion flaw exposes agent traffic.
0:19Another flaw lets unauthenticated parties add or delete trusted certificates.
0:24Dual-NIC setups limit exposure; patching still matters.
0:30No threat actor: this was defensive research.
0:34No malicious indicators were published.
0:408 ATT&CK techniques, from initial access to impact.
0:443 steps now: Upgrade Ivanti EPM to 2024 SU8.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.