CVE-2026-8111
📛 CVE Title
CVE-2026-8111
Description
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- ivanti
- CVSS severity
- HIGH
- CVSS score
- 8.8 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.8 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-89 - Reserved
- 2026-05-07
- Published
- 2026-05-12 16:33 UTC
- Last updated
- 2026-05-13 05:57 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/8xxx/CVE-2026-8111.json
- Linked Threat
- CVE-2026-8111 — CVE-2026-8111
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-12 15:16:18 UTC
- NVD last modified
- 2026-05-12 19:17:48 UTC
- NVD CVSS v3.1
- 8.8 / 10 HIGH source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0035 (probability of exploitation in next 30 days)
- EPSS percentile
- 57.82% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD / KEV / EPSS data refreshed 2026-05-25 06:23 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-29491 - Assigner
- ivanti
- Published
- May 12, 2026, 2:33:45 PM
- Updated
- May 13, 2026, 3:57:54 AM
- EUVD base score (CVSS 3.1)
-
8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.3500
- Vendors
- Ivanti
- Products
-
Endpoint Manager (patch: 2024 SU6)
ENISA description: SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| ivanti | Endpoint Manager |
2024 SU6 (unaffected)
|
— |
Affected products — CPE 2.3 (9) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su4_security_release_1:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager:2024:su5:*:*:*:*:*:*
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:nvd.nist.gov
This is a potential security issue, you are being redirected to https://nvd.nist.gov
2026-05-22 17:37 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 17:37 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's February 2026 Patch Tuesday with security updates for 58 flaws, including 6 actively exploited and three publicly disclosed zero-day vulnerabilities.
2026-05-22 17:37 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 17:37 UTC -
web:www.crowdstrike.com
Microsoft's February 2026 Patch Tuesday addresses 59 CVEs , featuring six exploited vulnerabilities, three of which were publicly known, and five Critical vulnerabilities.
2026-05-22 17:37 UTC -
web:www.notebookcheck.net
Microsoft's February 2026 Windows 11 updates (KB5077181 and KB5075941) add security patches, bug fixes, and new Secure Boot rollout signals ahead of certificate expirations starting in June 2026 .
2026-05-22 17:37 UTC -
web:www.tenable.com
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
2026-05-22 17:37 UTC -
web:www.thehackerwire.com
CVE-2026-8111 is a High severity vulnerability (CVSS 8.8). SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote...
2026-05-22 17:37 UTC -
web:www.xda-developers.com
Windows 11's second emergency patch of the month fixes a nasty Outlook issue You no longer need to deploy your own fixes A few days ago, we caught wind that Outlook was really struggling on ...
2026-05-22 17:37 UTC -
web:zerodaysignal.com
May 2026 : This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026 . This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.
2026-05-22 17:37 UTC
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (3)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-8111 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-8111 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 Vendor Advisory
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-8111.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T03:57:54.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Endpoint Manager",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "2024 SU6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. "
}
],
"value": "SQL injection in the web console\u00a0of Ivanti Endpoint Manager\u00a0before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T14:33:45.708Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-8111",
"datePublished": "2026-05-12T14:33:45.708Z",
"dateReserved": "2026-05-07T16:20:44.212Z",
"dateUpdated": "2026-05-13T03:57:54.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}