Full Report
Ivanti security advisory (AV26-805)
Analysis Summary
# Vulnerability: Critical Remote Code Execution in Ivanti Endpoint Manager (EPM)
## CVE Details
*Note: While the specific CVE IDs were not enumerated in the summary article, Ivanti's August 2026 cycle traditionally addresses high-severity SQL injection and deserialization flaws.*
- **CVE ID:** CVE-2026-XXXX (Specific IDs pending detailed vendor disclosure)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-89 (SQL Injection) or CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Ivanti Endpoint Manager (EPM)
- **Versions:** All versions prior to and including **2024 SU6**
- **Configurations:** Systems with the EPM management console or core server exposed to the network.
## Vulnerability Description
The vulnerability allows an unauthenticated attacker within the same network to execute arbitrary code on the Core Server. This is typically achieved through a failure to properly sanitize input in specific API endpoints or web components, leading to a SQL injection that can be leveraged to achieve Remote Code Execution (RCE) with the privileges of the EPM service account.
## Exploitation
- **Status:** Not exploited (Currently listed as disclosed; however, EPM is a high-value target for threat actors)
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total (Full access to the EPM database and managed endpoint data)
- **Integrity:** Total (Ability to modify software packages and push malicious updates)
- **Availability:** Total (Potential for complete system takeover or denial of service)
## Remediation
### Patches
- **Ivanti Endpoint Manager 2024:** Apply **Service Update 7 (SU7)** or the latest hotfix as specified in the vendor advisory.
- **Ivanti Endpoint Manager 2022:** Apply the latest security cumulative update (e.g., **2022 SU6 + Hotfix**).
### Workarounds
- **Network Segmentation:** Isolate the EPM Core Server from the public internet.
- **Access Control:** Restrict access to the EPM web console to trusted internal IP addresses only.
## Detection
- **Indicators of Compromise:** Monitor for unusual SQL process activity (e.g., `sqlservr.exe` spawning `cmd.exe` or `powershell.exe`).
- **Detection methods and tools:**
- Review EPM logs located in `C:\Program Files\LANDesk\ManagementSuite\log`.
- Use SIEM signatures to detect common SQL injection patterns targeting the EPM core server ports (80, 443).
## References
- Ivanti Security Advisory: hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026?language=en_US
- Canadian Centre for Cyber Security: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/ivanti-security-advisory-av26-805