CVE-2026-1602: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2026-1602 Overview

CVE-2026-1602 is a SQL injection vulnerability in Ivanti Endpoint Manager affecting all releases before version 2024 SU5. A remote authenticated attacker can inject crafted SQL statements through an affected input vector to read arbitrary data from the backing database. The flaw maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Ivanti disclosed the issue in its February 2026 security advisory for Endpoint Manager 2024. Exploitation does not require user interaction and can be performed over the network, but the attacker must first hold valid credentials on the management console.

Critical Impact

Authenticated attackers can extract sensitive endpoint management data, including device inventories, configuration details, and potentially stored credentials, by issuing crafted SQL queries.

Affected Products

• Ivanti Endpoint Manager 2024 (base release)
• Ivanti Endpoint Manager 2024 SU1, SU2, SU3, SU3 Security Release 1
• Ivanti Endpoint Manager 2024 SU4 and SU4 SR1

Discovery Timeline

• 2026-02-10 - CVE-2026-1602 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-1602

Vulnerability Analysis

The vulnerability resides in a server-side component of Ivanti Endpoint Manager that constructs SQL queries using untrusted input from an authenticated session. Because user-supplied values are concatenated into the query string rather than bound as parameters, an attacker can break out of the intended query context and append arbitrary SQL clauses.

The confidentiality impact is rated high while integrity and availability are unaffected, indicating the flaw exposes a read primitive against the database. Endpoint Manager stores extensive operational data, including managed device records, software inventory, patch state, and administrative configuration. A successful attacker can enumerate this data through UNION-based extraction or boolean and time-based blind techniques.

The attack surface is reachable over the network on the standard management interface, so any user with low-privilege console access becomes a viable threat actor. Internal users, compromised service accounts, and attackers who chain a credential theft step against the console are all in scope.

Root Cause

The root cause is improper neutralization of special elements in a SQL statement [CWE-89]. The affected code path fails to use parameterized queries or strict input validation before passing values to the database layer, allowing SQL metacharacters to alter query structure.

Attack Vector

An authenticated attacker submits a crafted request to the Endpoint Manager console containing SQL syntax in a parameter that feeds a vulnerable query. The injected payload executes within the database account used by the application, returning records that the application would otherwise restrict. No exploit code is publicly available at the time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Ivanti Security Advisory February 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-1602

Indicators of Compromise

• Web server or application logs containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or WAITFOR DELAY in request parameters to Endpoint Manager endpoints.
• Unexpected long-running queries or high-volume SELECT activity originating from the Endpoint Manager service account against management database tables.
• Authenticated console sessions issuing repeated requests to the same endpoint with incrementally varying parameter values, consistent with blind SQL injection enumeration.

Detection Strategies

• Enable verbose request logging on the Endpoint Manager web tier and alert on payload patterns associated with SQL injection probes.
• Deploy database activity monitoring on the Endpoint Manager database to flag queries that deviate from the application's known query fingerprints.
• Correlate authenticated user sessions with anomalous response sizes or response time distributions, which often indicate UNION and time-based extraction.

Monitoring Recommendations

• Review console audit logs for low-privilege accounts performing actions outside their normal role scope.
• Forward Endpoint Manager application, IIS, and SQL Server logs to a centralized analytics platform for retention and retrospective hunting.
• Track failed and successful logins to the management console and investigate any account that begins issuing unusual query-bearing requests after authentication.

How to Mitigate CVE-2026-1602

Immediate Actions Required

• Upgrade Ivanti Endpoint Manager 2024 to SU5 or later on all management servers as soon as change windows allow.
• Inventory all administrative and operator accounts on the console and disable any that are unused, shared, or hold privileges beyond business need.
• Rotate credentials for service accounts and reduce database account permissions to the minimum required by the application.

Patch Information

Ivanti addressed CVE-2026-1602 in Endpoint Manager 2024 SU5. Apply the update referenced in the Ivanti Security Advisory February 2026. No supported workaround replaces the vendor patch.

Workarounds

• Restrict network access to the Endpoint Manager console to trusted administrative networks and jump hosts using firewall or VPN controls.
• Enforce multi-factor authentication on all console accounts to raise the cost of acquiring the authenticated foothold the exploit requires.
• Monitor and rate-limit requests to the console at the reverse proxy or WAF layer to slow automated SQL injection enumeration.

# Example: restrict access to the Ivanti EPM console to a trusted admin subnet
# (adjust interface, source range, and listening port to match your deployment)
netsh advfirewall firewall add rule \
    name="Ivanti EPM Console - Admin Only" \
    dir=in action=allow protocol=TCP localport=443 \
    remoteip=10.10.50.0/24 profile=any