CVE-2026-8111: Ivanti Endpoint Manager RCE Vulnerability

CVE-2026-8111 Overview

CVE-2026-8111 is a SQL injection vulnerability in the web console of Ivanti Endpoint Manager (EPM) versions prior to 2024 SU6. An authenticated remote attacker can inject malicious SQL statements through the web console and escalate the flaw into remote code execution on the underlying server. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

An authenticated attacker can execute arbitrary code on the EPM server, compromising confidentiality, integrity, and availability of the endpoint management infrastructure used to administer managed devices across the enterprise.

Affected Products

• Ivanti Endpoint Manager 2024 (base release)
• Ivanti Endpoint Manager 2024 SU1 through SU5, including SU3 Security Release 1 and SU4 Security Release 1
• All Ivanti Endpoint Manager builds prior to 2024 SU6

Discovery Timeline

• 2026-05-12 - CVE-2026-8111 published to the National Vulnerability Database
• 2026-05-12 - Ivanti publishes the Ivanti Endpoint Manager May 2026 Security Advisory
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8111

Vulnerability Analysis

The vulnerability resides in the Ivanti EPM web console, which accepts user-supplied parameters and concatenates them into SQL queries without proper neutralization. An authenticated attacker submits crafted input that alters the query structure executed by the backend database. Because EPM uses a privileged service account to interact with its database tier, injected statements can leverage built-in database functionality, such as extended stored procedures, to spawn operating system commands. This pivot transforms a data-layer flaw into full remote code execution on the EPM server.

Root Cause

The root cause is improper input neutralization in a web console request handler. User input is incorporated into SQL queries using string concatenation or unparameterized query construction. The application fails to enforce strict type checks or use prepared statements, allowing attacker-controlled metacharacters to terminate the intended query and append arbitrary SQL.

Attack Vector

Exploitation requires network access to the EPM web console and valid authenticated credentials. The attacker submits a malicious request to a vulnerable web console endpoint that includes SQL syntax in a parameter the application trusts. The injected payload modifies the executing query and chains into command execution primitives available to the database service account. No user interaction is required, and the attack proceeds in a single request flow.

No public proof-of-concept exploit is currently available. Refer to the Ivanti Security Advisory for vendor technical context.

Detection Methods for CVE-2026-8111

Indicators of Compromise

• Unexpected child processes spawned by the EPM database service account, such as cmd.exe, powershell.exe, or xp_cmdshell invocations.
• Anomalous outbound network connections originating from the EPM server or its database host.
• Web console request logs containing SQL metacharacters such as single quotes, UNION SELECT, ;--, or encoded equivalents in parameter values.
• New or modified service accounts, scheduled tasks, or files written to EPM application directories without a corresponding change record.

Detection Strategies

• Inspect IIS and EPM application logs for authenticated requests containing SQL injection patterns directed at console endpoints.
• Correlate authentication events with database query telemetry to identify users issuing queries inconsistent with normal console workflows.
• Monitor for process lineage anomalies where SQL Server or the EPM service launches shell interpreters or scripting engines.

Monitoring Recommendations

• Enable verbose web console access logging and forward logs to a centralized analytics platform for retention and query.
• Establish baselines for typical EPM administrator activity and alert on deviations such as new endpoints accessed or atypical parameter values.
• Track patch state of all EPM servers and confirm they report version 2024 SU6 or later after remediation.

How to Mitigate CVE-2026-8111

Immediate Actions Required

• Upgrade Ivanti Endpoint Manager to version 2024 SU6 or later in accordance with the vendor advisory.
• Audit all EPM web console accounts and revoke credentials that are unused, shared, or no longer required.
• Enforce multi-factor authentication for every account permitted to access the EPM web console.
• Review web console and database logs for indicators of prior exploitation dating back to the deployment of the affected version.

Patch Information

Ivanti has released Endpoint Manager 2024 SU6, which remediates CVE-2026-8111. Administrators should consult the Ivanti Endpoint Manager May 2026 Security Advisory for the full list of fixed issues and download instructions. Apply the update in a test environment first, then roll out to production EPM servers following standard change-control procedures.

Workarounds

• Restrict network access to the EPM web console using firewall rules or VPN segmentation so only trusted administrative networks can reach it.
• Apply the principle of least privilege to the EPM database service account, removing capabilities such as xp_cmdshell where operationally feasible.
• Place the EPM web console behind a web application firewall configured with SQL injection rule sets while preparing to deploy the patch.

# Configuration example: restrict EPM web console access at the host firewall (Windows)
New-NetFirewallRule -DisplayName "Restrict EPM Console" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow