← All Advisories

Ivanti Endpoint Manager Web Console SQL Injection Allows an Authenticated Remote Attacker to Execute Code on the Server

Last refreshed2026-09-29

Status: UPDATED  |  Advisory ID: CVE-2026-8111

Key Details

CVECVE-2026-8111
CVSS Score / Version8.8 (High) / CVSS v3.1
Updated2026-06-17
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsIvanti endpoint_manager
Classified asCWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
Ivantiendpoint_manager
SubsystemsGeneral OT
SectorsMultiple

What to Know

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

What to Do

Monitor Ivanti's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-8111
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-8111
Vendor advisoryhttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US