Ivanti Endpoint Manager CVE-2025-62386

Requires an authenticated session with at least low-privilege access to Ivanti Endpoint Manager (PR:L) that is network-reachable; no user interaction and no special non-default configuration are indicated. Exploitation is limited to database read (confidentiality only) - no data modification or service disruption. The primary limiting factor is the authentication requirement, meaning the attacker must first possess or obtain valid EPM credentials; versions at or above 2024 SU5 are not affected.

This is a credible but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication, yielding high confidentiality impact (arbitrary database read) with no integrity or availability impact - consistent with a read-only SQLi (CWE-89). The signals are internally consistent and non-conflicting: EPSS is 0.82% (56th percentile), which is modestly above median but not indicative of imminent mass exploitation; there is no CISA KEV listing and no public proof-of-concept identified at time of analysis. Ivanti Endpoint Manager has, however, been a repeated and attractive target for threat actors historically, and a patch exists (2024 SU5), so the realistic risk is driven more by product desirability and the authenticated-but-low-bar prerequisite than by current exploitation telemetry. Net: a real fix-worthy vulnerability - prioritize patching given Ivanti's exploitation track record - but not an emergency compared to an unauthenticated or actively-exploited flaw. No key CVSS/description conflict exists; the vector and the 'remote authenticated' description agree.

A low-privileged authenticated user of the Ivanti Endpoint Manager console (or an attacker who has obtained such credentials) sends a crafted request to a vulnerable parameter, injecting SQL that the backend executes against the EPM database. The attacker uses the injection to read arbitrary data - potentially credentials, device inventory, or configuration secrets - without needing admin rights or user interaction. No public exploit code has been identified at time of analysis, so an attacker would need to develop or reverse-engineer the injection point.