Is CVE-2026-8111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8111 being exploited in the wild.

How severe is CVE-2026-8111?

High severity, with a CVSS score of 8.8, published 12 May 2026.

Which products and versions are affected?

Ivanti Endpoint Manager Before 2024 SU6, including 2022 and 2024 versions up to SU5.

Is there a fix for CVE-2026-8111?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8111 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8111?

Check whether you run Ivanti Endpoint Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8111: Ivanti Endpoint Manager SQL injection in web console

CVE-2026-8111 · Severity: high · CVSS 8.8 · Published 2026-05-12

Ivanti Endpoint Manager is a centralized console used by IT departments to manage and secure devices across a corporate network. A security vulnerability in its web-based management interface allows an attacker with basic user credentials to execute unauthorized commands on the server. This could lead to a complete takeover of the management system, potentially allowing the attacker to compromise all connected devices or disrupt business operations.

Technologies: Ivanti Endpoint Manager. Vendors: Ivanti.

Quick answers

Is CVE-2026-8111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8111 being exploited in the wild.
How severe is CVE-2026-8111?: High severity, with a CVSS score of 8.8, published 12 May 2026.
Which products and versions are affected?: Ivanti Endpoint Manager Before 2024 SU6, including 2022 and 2024 versions up to SU5.
Is there a fix for CVE-2026-8111?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8111 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8111?: Check whether you run Ivanti Endpoint Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in the web console component of Ivanti Endpoint Manager (EPM). The flaw is caused by improper neutralization of special elements within SQL commands processed by the web interface. A remote attacker with low-privileged authentication can exploit this by sending specially crafted requests to the web console, leading to arbitrary remote code execution (RCE) on the EPM core server. The vulnerability affects versions prior to 2024 SU6, including the 2022 release branch and 2024 releases up to SU5. Ivanti has released version 2024 SU6 to address this issue.

Affected products

Ivanti Endpoint Manager (EPM) Before 2024 SU6, including 2022 and 2024 versions up to SU5

Timeline

2026-05-12: disclosed
2026-05-12: advisory: Vendor advisory published by Ivanti

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.