SB2026081131 - Improper Neutralization of Special Elements in Data Query Logic in Ivanti Neurons for MDM (N-MDM)

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: N/A)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements in data query logic in data query logic when handling crafted queries. A remote privileged user can send crafted query input to disclose sensitive information.

The issue can expose information from other tenants on the same server.

Remediation

Install update from vendor's website.

References

• https://hub.ivanti.com/s/article/August-2026-Security-Advisory-Ivanti-Neurons-for-MDM?language=en_US
• https://success.ivanti.com/