CVE-2026-1602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1602", "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "state": "PUBLISHED", "assignerShortName": "ivanti", "dateReserved": "2026-01-29T09:18:47.171Z", "datePublished": "2026-02-10T15:07:27.198Z", "dateUpdated": "2026-11-04T00:18:07.624Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Endpoint Manager", "vendor": "Ivanti", "versions": [{"status": "unaffected", "version": "2024 SU5"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "&nbsp; <br>SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database."}], "value": "SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "shortName": "ivanti", "dateUpdated": "2026-02-10T15:07:27.198Z"}, "references": [{"url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T04:56:28.564504Z", "id": "CVE-2026-1602", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T00:18:07.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T04:56:28.564504Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:00:56.884Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ivanti", "product": "Endpoint Manager", "versions": [{"status": "unaffected", "version": "2024 SU5"}], "defaultStatus": "affected"}], "references": [{"url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.", "supportingMedia": [{"type": "text/html", "value": "&nbsp; <br>SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "shortName": "ivanti", "dateUpdated": "2026-02-10T15:07:27.198Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1602", "state": "PUBLISHED", "dateUpdated": "2026-11-04T00:18:07.624Z", "dateReserved": "2026-01-29T09:18:47.171Z", "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "datePublished": "2026-02-10T15:07:27.198Z", "assignerShortName": "ivanti"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Endpoint Manager", "vendor": "Ivanti", "versions": [{"status": "unaffected", "version": "2024 SU5"}]}], "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "7ABDE6FE-56CC-4A46-91F2-2F54C3EC6A75", "versionEndExcluding": "2024", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*", "matchCriteriaId": "6C7283FE-C10A-4E37-B004-15FB0CAC49A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:*", "matchCriteriaId": "FC51EEA2-1C4C-4069-9704-7ACFE4773930", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:*", "matchCriteriaId": "E1EF5E1B-9377-49D3-9BE3-62FC78E666A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:*", "matchCriteriaId": "749AADDA-834D-4EC0-B7FF-E136FD1984F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:*", "matchCriteriaId": "698BF7A1-62A1-45B5-BF08-AB3F3AA0245C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:*", "matchCriteriaId": "4902A745-E7CB-4FC9-9BCB-89EFAB643237", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su4_sr1:*:*:*:*:*:*", "matchCriteriaId": "96504BF5-A81F-4A69-A183-BC80FA0321DE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database."}, {"lang": "es", "value": "Inyecci\u00f3n SQL en Ivanti Endpoint Manager anterior a la versi\u00f3n 2024 SU5 permite a un atacante remoto autenticado leer datos arbitrarios de la base de datos."}], "id": "CVE-2026-1602", "lastModified": "2026-06-17T10:16:09.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1602", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T04:56:28.564504Z", "version": "2.0.3"}}]}, "published": "2026-02-10T16:16:10.387", "references": [{"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "tags": ["Vendor Advisory"], "url": "https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US"}], "sourceIdentifier": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "2024 SU5"}}], "product": "endpoint_manager", "vendor": "ivanti"}], "analysis": {"en": {"generated_at": "2026-04-17T20:48:38.744389+00:00", "value": {"mitigation_remediation": ["Apply the latest Ivanti Endpoint Manager SU5 release or newer to remove the flaw.", "If an immediate upgrade is not possible, restrict the affected user's permissions to the minimum required for their role and monitor for suspicious database activity.", "Deploy application-layer defenses such as web application firewalls, and enforce strict input validation or use parameterized queries if custom code is present."], "summary": {"action": "Patch", "impact": "Data Exposure via SQL Injection"}, "threat_synthesis": {"affected_systems": "Affected versions include Ivanti Endpoint Manager 2024 prior to the SU5 release. All service\u2011update branches up to SU4, including SU1, SU2, SU3, and SU3 security release 1, SU4, SU4 sr1, and the generic 2024 release, are impacted. The impact applies to any deployment where the console runs on a machine that exposes a database and an authenticated session. All instances that have the vulnerable component and allow a user to submit the affected input are at risk.", "description_and_impact": "The vulnerability is a classic SQL injection in the data access layer of Ivanti Endpoint Manager. An authenticated user who can log into the console can exploit a flaw in the input validation of a query parameter, enabling them to inject arbitrary SQL and read any table in the underlying database. This results in non\u2011destructive data exposure; attackers cannot modify data, but can compromise confidentiality of sensitive configuration, user credentials, or internal network information. The weakness is categorized as CWE-89.", "risk_and_exploitability": "The issue is scored CVSS 6.5, indicating moderate severity. EPSS is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability appears in the KEV catalog only as not listed, so no widespread exploitation is documented. The realistic attack surface requires an insider or compromised user account with at least read privileges. Considering the need for authentication, the risk to an organization hinges on password hygiene and segregation of duties. If an attacker gains the necessary credentials, they can read arbitrary data, but not execute code or modify data. The combination of moderate CVSS and very low EPSS puts the overall risk at moderate but with limited active exploitation pressure."}}}}, "created": "2026-02-10T16:26:46.794530+00:00", "title": "SQL Injection in Ivanti Endpoint Manager Enables Remote Authenticated Data Retrieval", "updated": "2026-04-17T21:00:12.694803+00:00", "vendors": ["ivanti", "ivanti$PRODUCT$endpoint_manager"]}