Ivanti Endpoint Manager CVE-2025-11623

Exploitation requires the attacker to first authenticate to Ivanti Endpoint Manager with at least low-privilege credentials (CVSS PR:L), so this is a post-authentication flaw - not remote-unauthenticated. The affected component is reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), meaning a valid account is the primary gate. The limiting factors defenders should weigh: a valid EPM account is mandatory, the vulnerability is confined to systems running versions before 2024 SU5, and impact is read-only (C:H, I:N, A:N) so no data modification or service disruption occurs. Risk is meaningfully reduced where the EPM console is not internet-exposed and account provisioning is tightly controlled.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable SQL injection that requires authentication (PR:L) but no user interaction, yielding high confidentiality impact (arbitrary database read) with no integrity or availability impact. The EPSS score of 0.83% (56th percentile) indicates a low-to-modest near-term exploitation probability, and the vulnerability is NOT listed in CISA KEV and has no public exploit code identified, so there is no evidence of active or imminent mass exploitation. The signals are internally consistent: a credentialed-attacker, read-only data-disclosure flaw in enterprise management software is the kind of bug typically used in targeted post-authentication lateral movement rather than opportunistic internet-wide scanning, which aligns with the low EPSS. No SSVC decision data was provided in the input, so exploitation/automatable/technical-impact classifications cannot be cited. The one caveat: Ivanti products have historically been high-value targets that attract rapid exploit development once details are public, so despite benign current telemetry the patch should be applied on a normal-to-expedited cadence, prioritized for internet-exposed EPM consoles.

An attacker who already holds valid low-privileged credentials to the Ivanti Endpoint Manager web interface submits a crafted request to a vulnerable parameter, injecting SQL that the application executes against its backend database. Because the flaw grants arbitrary read access (C:H), the attacker extracts sensitive data such as credentials, device inventory, or configuration from the EPM database. No public proof-of-concept exploit has been identified at the time of analysis, and exploitation requires prior authentication, raising the practical bar.