CVE-2026-1602: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

CVE-2026-1602 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote authenticated attacker to read arbitrary data from the database. It affects all EPM 2024 versions prior to 2024 SU5, including 2024, 2024-SU1, 2024-SU2, 2024-SU3, 2024-SU3 Security Release 1, 2024-SU4, and 2024-SU4 SR1. The vulnerability was published on February 10, 2026, with a patch released on February 12, 2026. It carries a CVSS v3.1 base score of 6.5 (High) (Feedly, ZDI).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and resides in the ROI class of Ivanti Endpoint Manager. The flaw stems from insufficient validation of user-supplied strings before they are incorporated into SQL queries, enabling an authenticated attacker to inject malicious SQL via network-accessible endpoints. Exploitation requires only low-privileged credentials and no user interaction, making it straightforward for any authenticated user to abuse. A proof-of-concept advisory was published by the Zero Day Initiative (ZDI-26-079) (ZDI, Feedly).

Successful exploitation allows an authenticated attacker to read arbitrary data from the EPM database over the network, resulting in high confidentiality impact with no integrity or availability impact. Sensitive information stored in the EPM database — such as managed endpoint configurations, credentials, and organizational data — may be exposed. According to ZDI, the vulnerability could also potentially be leveraged to execute code in the context of the service account, increasing the risk of lateral movement within the environment (ZDI, Feedly).

A proof-of-concept advisory (ZDI-26-079) was published by the Zero Day Initiative on February 12, 2026, shortly after the vulnerability was disclosed (ZDI). As of the time of reporting, no active in-the-wild exploitation of CVE-2026-1602 specifically has been confirmed, though related Ivanti EPM vulnerabilities disclosed in the same advisory batch have drawn CISA attention. The EPSS score is approximately 0.054%, indicating a currently low but non-negligible probability of exploitation. The vulnerability is detectable via Qualys (detection IDs 386530, 530935) and Nessus (detection ID 298947) (Feedly).

1. Reconnaissance: Identify Ivanti Endpoint Manager instances running versions prior to 2024 SU5 using network scanning tools or Shodan, targeting exposed management interfaces.
2. Authentication: Obtain low-privileged credentials for the EPM system — these may be acquired through phishing, credential stuffing, or reuse of previously leaked credentials.
3. Identify vulnerable endpoint: Locate the network-accessible endpoint or API associated with the EPM ROI class that processes user-supplied input without adequate sanitization.
4. Craft SQL injection payload: Construct a malicious SQL injection string (e.g., using UNION-based or blind SQL injection techniques) and inject it into the vulnerable parameter of the targeted request.
5. Extract database contents: Retrieve arbitrary data from the EPM database, including sensitive configuration data, managed endpoint details, or stored credentials, by iterating through tables and columns.
6. Potential privilege escalation: Leverage extracted credentials or service account context to attempt lateral movement or code execution within the environment (ZDI, Feedly).

• Network: Unusual or repeated authenticated HTTP requests to EPM management endpoints containing SQL metacharacters (e.g., ', --, UNION, SELECT) in query parameters; unexpected outbound database query traffic.
• Logs: EPM application logs showing malformed or anomalous SQL-related errors originating from authenticated sessions; repeated access to ROI class endpoints from a single low-privileged account.
• Database: Unexpected or high-volume SELECT queries against sensitive EPM database tables; queries referencing system tables (e.g., information_schema, sysobjects) from the EPM service account.
• Process: Unusual child processes or scripts spawned by the EPM service account following authenticated sessions (ZDI, Feedly).

Ivanti has released a patch in Ivanti Endpoint Manager 2024 SU5, which resolves this vulnerability. All affected versions (2024, 2024-SU1, 2024-SU2, 2024-SU3, 2024-SU3 Security Release 1, 2024-SU4, and 2024-SU4 SR1) should be upgraded to 2024 SU5 or later as the primary remediation. As interim measures, organizations should restrict network access to the EPM management interface and limit user account privileges to reduce the attack surface while patching is underway (Ivanti Advisory, Feedly).

The vulnerability was covered by multiple cybersecurity news outlets including CyberSecurityNews, GBHackers, SecurityAffairs, and CyberPress, largely in the context of a broader batch of Ivanti EPM vulnerabilities patched in February 2026 that included more severe authentication bypass flaws (SecurityAffairs). CIS and Belgium's CCB issued advisories recommending urgent patching (CIS Advisory). Community sentiment on Infosec.Exchange noted the pattern of recurring Ivanti EPM SQL injection vulnerabilities. CISA subsequently issued warnings related to the broader Ivanti EPM advisory batch, though specific KEV attribution to CVE-2026-1602 was not confirmed at time of reporting.