Ivanti Endpoint Manager CVE-2025-62387

Exploitation requires valid authenticated access to Ivanti Endpoint Manager at a low privilege level (CVSS PR:L) and a network path to the application (AV:N); it does not require user interaction or administrative rights. The limiting factor is that the attacker must first possess working application credentials - this is not a pre-authentication flaw - which meaningfully constrains opportunistic exploitation to insiders, credential-theft scenarios, or chained post-authentication attacks. Impact is bounded to reading arbitrary database data (C:H, I:N, A:N); it does not by itself permit data modification, code execution, or denial of service. Affected deployments are Ivanti Endpoint Manager versions prior to 2024 SU5 (including 2024, SU1, SU2, SU3, and SU3 Security Release 1 per the CPE list); upgrading to 2024 SU5 remediates.

This is a moderate-severity, authenticated SQL injection (CWE-89) in Ivanti Endpoint Manager. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable, low attack complexity, requires low-privileged authentication (PR:L), no user interaction, and confidentiality-only impact (read arbitrary database data) with no integrity or availability impact. There is no CISA KEV listing and no public exploit (POC) indicated in the input, so exploitation status is 'no public exploit identified at time of analysis.' The EPSS score of 1.73% (77th percentile) is modestly elevated but still low in absolute terms, consistent with the absence of confirmed in-the-wild activity - not a mass-exploitation signal. No SSVC decision data was provided. The key tempering factor is the authentication requirement: unlike Ivanti's history of unauthenticated pre-auth RCE flaws, this requires an attacker to already hold valid low-privilege credentials, and the impact is limited to data disclosure (no RCE, no write, no DoS). Net: a real but secondary priority - patch in normal cycle, prioritized above baseline because Ivanti EPM is a high-value administrative target and the vendor has a strong history of attacker interest, but well below any unauthenticated or KEV-listed Ivanti CVE.

An attacker who has obtained valid low-privilege credentials to the Ivanti Endpoint Manager application sends a crafted request containing malicious SQL to a vulnerable input parameter, which is concatenated unsanitized into a backend query. The injection lets them read arbitrary data from the EPM database - potentially including managed-device inventory, configuration, and credential or token material. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once authenticated.