CVE-2026-8111

Description

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

PUBLISHED Reserved 2026-05-07 | Published 2026-05-12 | Updated 2026-05-13 | Assigner ivanti

Problem types

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Product status

References

hub.ivanti.com/...dpoint-Manager-EPM-May-2026?language=en_US

cve.org (CVE-2026-8111)

nvd.nist.gov (CVE-2026-8111)

Download JSON