Ivanti · Endpoint Manager (EPM)
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
What it is
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CISA: Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 23, 2024
- Added to the CISA list
- October 2, 2024
- Published
- May 31, 2024
- Severity
- Critical 9.6 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-89
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 10, 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Critical 9.8 | >99.9% |
| Mar 10, 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Critical 9.8 | 91% |
| Mar 10, 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Critical 9.8 | 90% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
| May 7, 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | High 7.2 | 34% |
| Apr 8, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Mar 9, 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | High 8.6 | 88% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.