Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Ivanti Releases Critical Security Update for Endpoint Manager

Successful exploitation of CVE-2026-121653 could allow an unauthenticated attacker to achieve remote code execution

Threat ID:
CC-4890
Threat Severity:
Medium
Published:
11 November 2026 3:47 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-121653 could allow an unauthenticated attacker to achieve remote code execution

Affected platforms

The following platforms are known to be affected:

Ivanti Endpoint Manager

  • All prior to version 2024 SU8

Threat details

Introduction

Ivanti has released a security update covering two security fixes including a critical severity vulnerability in Ivanti EPM (Endpoint Manager).

  • CVE-2026-121653 - "SQL injection" vulnerability - CVSSv3.1 score: 9.8
  • CVE-2026-18128 - 'Cleartext transmission of sensitive information' vulnerability - CVSSv3.1 score: 6.8

Remediation advice

Affected organisations are encouraged to review Ivanti's Security Advisory Ivanti Endpoint Manager (EPM) November 2026 and apply the relevant update. 

Last edited: 11 November 2026 3:47 pm