---
id: CVE-2026-1602
title: >-
  SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a
  remote authenticated attacker to read arbitrary data from the database.
summary: >-
  SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a
  remote authenticated attacker to read arbitrary data from the database.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: Ivanti
product: Endpoint Manager
affected:
  - endpoint_manager (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-02-18T04:56:28.564504Z'
published: '2026-02-10'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:18:07.624Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-1602'
references:
  - url: >-
      https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US
tags:
  - cve.org
epss: 0.00814
epssPercentile: 0.57152
ingestedAt: '2026-11-05T20:33:06.654Z'
---

## Overview

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

## Affected

- `endpoint_manager (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.