SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
References
| Link | Resource |
|---|---|
| https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Feb 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US - Vendor Advisory | |
| First Time |
Ivanti
Ivanti endpoint Manager |
|
| CPE | cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su4_sr1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* |
10 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-10 16:16
Updated : 2026-02-12 15:16
NVD link : CVE-2026-1602
Mitre link : CVE-2026-1602
CVE.ORG link : CVE-2026-1602
JSON object : View
Products Affected
ivanti
- endpoint_manager
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')