Endpoint Manager
Monthly
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Full write control over configured S3 session recording buckets is achievable in Ivanti Endpoint Manager (EPM) before version 2024 SU7 by remote authenticated attackers exploiting a CWE-73 filename control flaw. The Core component fails to sanitize user-supplied input used to construct S3 object paths, enabling any low-privilege authenticated EPM user to write arbitrary data to the session recording bucket - potentially overwriting or corrupting forensic evidence. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available as EPM 2024 SU7.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosure, completing the triple path traversal set in the January 2025 security update.
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosure, part of the triple path traversal affecting EPM's January 2025 security update.
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to leak sensitive information from the EPM server, one of three related Ivanti EPM path traversal CVEs.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated attackers can exploit SQL injection in Ivanti Endpoint Manager prior to version 2024 SU5 to extract sensitive data from the underlying database. This network-accessible vulnerability requires valid credentials but allows unauthorized information disclosure with no user interaction needed. No patch is currently available for affected systems.
Ivanti Endpoint Manager fails to properly verify cryptographic signatures on patch and update packages processed by its patch management component (CWE-347), allowing a crafted package bearing a forged or invalid signature to be accepted and executed. Per the vendor CVSS vector (AV:L/AC:L/PR:N/UI:R), the attack requires delivery of a malicious update package to the affected component and a mandatory user-interaction step before arbitrary code executes, so it is not a hands-off remote exploit despite the description's 'remote' wording; only Endpoint Manager builds at or below 2024 SU4 (including 2024, SU1, SU2, SU3, SU3 SR1 and SU4) are affected. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV; a vendor fix is available in 2024 SU4 SR1 and later.
Path traversal in Ivanti Endpoint Manager 2024 through 2024 SU4 (including SU1, SU2, SU3, and SU3 Security Release 1) lets a remote attacker who already holds valid authenticated access, and who can also induce a legitimate user to perform an action, write arbitrary files outside the intended target directory on the EPM server. The two prerequisites - authenticated access (CVSS PR:L) plus required user interaction (CVSS UI:R) - substantially limit the exposure compared with an unauthenticated, fully automated attack, though the impact of a successful write is high (CVSS Integrity/High, Availability/High; vendor score 8.0, independent assessment 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in Ivanti Endpoint Manager 2024 SU4 SR1. This is a credible, above-average priority issue but not a drop-everything emergency based on current signals.
Arbitrary file write on the Ivanti Endpoint Manager server, exploitable by a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) when the victim performs an attacker-influenced action, with the potential to escalate to remote code execution on the EPM host. All EPM 2024 releases prior to 2024 SU4 SR1 are affected, including the 2024 base release through SU1, SU2, SU3, SU3 Security Release 1, and SU4. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), though the unauthenticated network vector combined with high confidentiality and integrity impact makes it a credible high-priority patch item; the mandatory user interaction (UI:R) is the principal limiting factor.
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3 Security Release 1) lets a remote unauthenticated attacker plant a persistent JavaScript payload that executes in the browser context of an administrator's EPM console session once that administrator views the poisoned page. Because the script runs inside an authenticated admin session, it can read or modify administrative data and perform actions as the victim, though the scope-limited CVSS impact (C:L/I:L/A:N) and the mandatory administrator interaction (UI:R) constrain the damage. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, but the EPSS score is elevated at 33.50% (98th percentile), indicating strong model-based likelihood of exploitation attempts; the vendor fix is Ivanti Endpoint Manager 2024 SU4 SR1.
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote attacker who holds valid low-privilege credentials (PR:L, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read arbitrary data from the product's backend database; no user interaction or administrative rights are required, but network reachability to the EPM interface and an authenticated session are prerequisites, so realistic exposure is limited to insiders, compromised accounts, or consoles reachable by lower-trust users. The vendor rates the issue 6.5 (moderate) with high confidentiality impact only, and no public exploit code has been identified at time of analysis; EPSS is 0.82% (56th percentile), indicating low near-term exploitation likelihood, and the vulnerability is not confirmed actively exploited (not listed in CISA KEV).
SQL injection in Ivanti Endpoint Manager (all builds before 2024 SU5) allows an already-authenticated, low-privileged user to read arbitrary data from the product's backend database. The flaw is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) but requires a valid session, and the impact is limited to confidentiality with no write or denial-of-service capability, making the authentication prerequisite the primary factor limiting exploitation. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is 0.82% (56th percentile), consistent with a moderate-priority, not high-urgency, issue.
Authenticated SQL injection in Ivanti Endpoint Manager allows low-privilege users to read arbitrary database contents, affecting versions prior to 2024 SU5. With a CVSS 3.1 score of 6.5 and EPSS of 1.74% (77th percentile), exploitation requires a valid EPM account, and no public exploit code has been identified at time of analysis. The confidentiality-only impact means attackers can exfiltrate sensitive data but cannot modify or delete it through this flaw alone.
SQL injection in Ivanti Endpoint Manager 2024 (through SU3, including SU1, SU2, SU3 and SU3 Security Release 1) allows a remote authenticated attacker to read arbitrary data from the underlying database. Exploitation requires valid EPM credentials (CVSS PR:L), which is the primary limiting factor and rules out anonymous internet attacks; no user interaction is needed and the impact is confined to confidentiality (C:H, I:N, A:N). At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the EPSS score of 1.74% (77th percentile) places it in the moderate-priority band rather than a top-tier emergency.
Authenticated SQL injection in Ivanti Endpoint Manager allows a low-privileged remote user to read arbitrary data from the underlying database, affecting 2024 releases prior to SU5 (2024 base, SU1, SU2, SU3, and SU3 Security Release 1). The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires a valid low-privilege session or credentials but no user interaction, and impact is confined to confidentiality - attackers can exfiltrate database contents but cannot modify or destroy data. Exploitation is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, EPSS is 0.82% (56th percentile), and exploitation is constrained to insiders, credential reuse/phishing, or chaining after another access-granting flaw.
Ivanti Endpoint Manager versions prior to 2024 SU5 contain a moderate-severity authenticated SQL injection (CWE-89) that allows a remote attacker with low-privileged credentials to read arbitrary data from the underlying database. Exploitation requires valid authentication and network access, but no user interaction or administrative rights, limiting opportunistic attacks to insiders or credential-theft scenarios. No public exploit code has been identified, and EPSS estimates a 1.73% (77th percentile) probability of exploitation in the next 30 days.
SQL injection in Ivanti Endpoint Manager before 2024 SU5 allows a remote authenticated attacker with low privileges to read arbitrary data from the product database; the assessed impact is confidentiality-only, with no data modification or service disruption. This issue is not confirmed actively exploited (CISA KEV), no public exploit identified at time of analysis, and EPSS is low at 0.82% (56th percentile). The primary limiting factor is the required authenticated session, and versions at or above 2024 SU5 are not affected.
Authenticated SQL injection in Ivanti Endpoint Manager 2024 through SU3 allows a remote attacker with valid EPM credentials to read arbitrary data from the product database, potentially exposing sensitive endpoint management records. The issue is fixed in 2024 SU5, but exploitation requires an existing login and no public exploit or CISA KEV activity is identified; EPSS is 0.82% (56th percentile), indicating limited real-world urgency.
SQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary data from the underlying database. The flaw affects Ivanti Endpoint Manager 2024 and its service updates up through SU3 (including SU3 security release 1) - any build prior to 2024 SU5. Exploitation requires valid low-privileged credentials (CVSS PR:L) and no user interaction, and the impact is limited to confidentiality (C:H/I:N/A:N), meaning data disclosure only with no ability to alter records or disrupt availability. No public exploit code has been identified and the CVE is not listed in CISA KEV; EPSS is low at 0.83% (56th percentile), so risk is driven primarily by the authentication prerequisite and the medium 6.5 severity.
SQL injection in Ivanti Endpoint Manager affects releases from 2024 through 2024 SU3 Security Release 1, allowing a remote attacker who holds valid EPM credentials to read arbitrary data from the underlying database; no user interaction is required and the flaw is network-reachable at low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, with no ability to modify data or disrupt service. The credential prerequisite (PR:L) is the principal limiting factor, so meaningful risk arises mainly where low-privileged EPM accounts are widely provisioned or where credentials can be obtained via reuse, phishing, or a separate intrusion path. EPSS is 0.83% (56th percentile), no public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); Ivanti has released a fix in version 2024 SU5.
SQL injection in Ivanti Endpoint Manager (all versions prior to 2024 SU5) allows an authenticated remote attacker with low-privilege credentials to read arbitrary data from the backend database. The vulnerability is post-authentication, requiring a valid EPM account, and impact is confined to confidentiality (read-only) with no modification or denial of service. No public exploit code has been identified at time of analysis, and EPSS score is 0.83% (56th percentile); however, because the flaw is network-reachable and low-complexity, it should be prioritized for patching, especially in internet-exposed deployments.
Remote code execution in Ivanti Endpoint Manager before version 2024 SU4 is achievable via a path-traversal flaw (CWE-22) that allows an unauthenticated remote attacker to escape intended directories and execute code on the EPM server, though the attack requires user interaction (UI:R) and thus cannot be fully autonomous. Affected versions include 2024, 2024 SU1, SU2, SU3, and SU3 Security Release 1, all fixed by upgrading to 2024 SU4. With an EPSS score of 15.33% (97th percentile) and no public exploit code or confirmed active exploitation identified at time of analysis, this is assessed as a high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Local privilege escalation in Ivanti Endpoint Manager allows an authenticated low-privilege attacker to gain high-integrity control of the host by feeding attacker-controlled serialized data into a vulnerable deserialization path in the EPM software. Affected builds are all EPM versions prior to 2024 SU4, specifically the 2024 base release and service updates SU1, SU2, SU3, and SU3 Security Release 1; systems already on 2024 SU4 or later are not affected. The attack requires an existing local authenticated session (PR:L, AV:L, no user interaction) and is not remotely reachable by an unauthenticated attacker; no public exploit identified at time of analysis, and EPSS is low at 0.78% (55th percentile), so this is a credible but not emergency-tier priority for most environments.
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
A security vulnerability in the agent of Ivanti Endpoint Manager (CVSS 8.4) that allows a local authenticated attacker. High severity vulnerability requiring prompt remediation.
A security vulnerability in the agent of Ivanti Endpoint Manager (CVSS 8.4) that allows a local authenticated attacker. High severity vulnerability requiring prompt remediation.
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 30.3% and no vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 26.5% and no vendor patch available.
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 43.8% and no vendor patch available.
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 21.5%.
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Full write control over configured S3 session recording buckets is achievable in Ivanti Endpoint Manager (EPM) before version 2024 SU7 by remote authenticated attackers exploiting a CWE-73 filename control flaw. The Core component fails to sanitize user-supplied input used to construct S3 object paths, enabling any low-privilege authenticated EPM user to write arbitrary data to the session recording bucket - potentially overwriting or corrupting forensic evidence. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available as EPM 2024 SU7.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosure, completing the triple path traversal set in the January 2025 security update.
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosure, part of the triple path traversal affecting EPM's January 2025 security update.
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to leak sensitive information from the EPM server, one of three related Ivanti EPM path traversal CVEs.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated attackers can exploit SQL injection in Ivanti Endpoint Manager prior to version 2024 SU5 to extract sensitive data from the underlying database. This network-accessible vulnerability requires valid credentials but allows unauthorized information disclosure with no user interaction needed. No patch is currently available for affected systems.
Ivanti Endpoint Manager fails to properly verify cryptographic signatures on patch and update packages processed by its patch management component (CWE-347), allowing a crafted package bearing a forged or invalid signature to be accepted and executed. Per the vendor CVSS vector (AV:L/AC:L/PR:N/UI:R), the attack requires delivery of a malicious update package to the affected component and a mandatory user-interaction step before arbitrary code executes, so it is not a hands-off remote exploit despite the description's 'remote' wording; only Endpoint Manager builds at or below 2024 SU4 (including 2024, SU1, SU2, SU3, SU3 SR1 and SU4) are affected. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV; a vendor fix is available in 2024 SU4 SR1 and later.
Path traversal in Ivanti Endpoint Manager 2024 through 2024 SU4 (including SU1, SU2, SU3, and SU3 Security Release 1) lets a remote attacker who already holds valid authenticated access, and who can also induce a legitimate user to perform an action, write arbitrary files outside the intended target directory on the EPM server. The two prerequisites - authenticated access (CVSS PR:L) plus required user interaction (CVSS UI:R) - substantially limit the exposure compared with an unauthenticated, fully automated attack, though the impact of a successful write is high (CVSS Integrity/High, Availability/High; vendor score 8.0, independent assessment 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in Ivanti Endpoint Manager 2024 SU4 SR1. This is a credible, above-average priority issue but not a drop-everything emergency based on current signals.
Arbitrary file write on the Ivanti Endpoint Manager server, exploitable by a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) when the victim performs an attacker-influenced action, with the potential to escalate to remote code execution on the EPM host. All EPM 2024 releases prior to 2024 SU4 SR1 are affected, including the 2024 base release through SU1, SU2, SU3, SU3 Security Release 1, and SU4. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), though the unauthenticated network vector combined with high confidentiality and integrity impact makes it a credible high-priority patch item; the mandatory user interaction (UI:R) is the principal limiting factor.
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3 Security Release 1) lets a remote unauthenticated attacker plant a persistent JavaScript payload that executes in the browser context of an administrator's EPM console session once that administrator views the poisoned page. Because the script runs inside an authenticated admin session, it can read or modify administrative data and perform actions as the victim, though the scope-limited CVSS impact (C:L/I:L/A:N) and the mandatory administrator interaction (UI:R) constrain the damage. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, but the EPSS score is elevated at 33.50% (98th percentile), indicating strong model-based likelihood of exploitation attempts; the vendor fix is Ivanti Endpoint Manager 2024 SU4 SR1.
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote attacker who holds valid low-privilege credentials (PR:L, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read arbitrary data from the product's backend database; no user interaction or administrative rights are required, but network reachability to the EPM interface and an authenticated session are prerequisites, so realistic exposure is limited to insiders, compromised accounts, or consoles reachable by lower-trust users. The vendor rates the issue 6.5 (moderate) with high confidentiality impact only, and no public exploit code has been identified at time of analysis; EPSS is 0.82% (56th percentile), indicating low near-term exploitation likelihood, and the vulnerability is not confirmed actively exploited (not listed in CISA KEV).
SQL injection in Ivanti Endpoint Manager (all builds before 2024 SU5) allows an already-authenticated, low-privileged user to read arbitrary data from the product's backend database. The flaw is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) but requires a valid session, and the impact is limited to confidentiality with no write or denial-of-service capability, making the authentication prerequisite the primary factor limiting exploitation. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is 0.82% (56th percentile), consistent with a moderate-priority, not high-urgency, issue.
Authenticated SQL injection in Ivanti Endpoint Manager allows low-privilege users to read arbitrary database contents, affecting versions prior to 2024 SU5. With a CVSS 3.1 score of 6.5 and EPSS of 1.74% (77th percentile), exploitation requires a valid EPM account, and no public exploit code has been identified at time of analysis. The confidentiality-only impact means attackers can exfiltrate sensitive data but cannot modify or delete it through this flaw alone.
SQL injection in Ivanti Endpoint Manager 2024 (through SU3, including SU1, SU2, SU3 and SU3 Security Release 1) allows a remote authenticated attacker to read arbitrary data from the underlying database. Exploitation requires valid EPM credentials (CVSS PR:L), which is the primary limiting factor and rules out anonymous internet attacks; no user interaction is needed and the impact is confined to confidentiality (C:H, I:N, A:N). At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the EPSS score of 1.74% (77th percentile) places it in the moderate-priority band rather than a top-tier emergency.
Authenticated SQL injection in Ivanti Endpoint Manager allows a low-privileged remote user to read arbitrary data from the underlying database, affecting 2024 releases prior to SU5 (2024 base, SU1, SU2, SU3, and SU3 Security Release 1). The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires a valid low-privilege session or credentials but no user interaction, and impact is confined to confidentiality - attackers can exfiltrate database contents but cannot modify or destroy data. Exploitation is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, EPSS is 0.82% (56th percentile), and exploitation is constrained to insiders, credential reuse/phishing, or chaining after another access-granting flaw.
Ivanti Endpoint Manager versions prior to 2024 SU5 contain a moderate-severity authenticated SQL injection (CWE-89) that allows a remote attacker with low-privileged credentials to read arbitrary data from the underlying database. Exploitation requires valid authentication and network access, but no user interaction or administrative rights, limiting opportunistic attacks to insiders or credential-theft scenarios. No public exploit code has been identified, and EPSS estimates a 1.73% (77th percentile) probability of exploitation in the next 30 days.
SQL injection in Ivanti Endpoint Manager before 2024 SU5 allows a remote authenticated attacker with low privileges to read arbitrary data from the product database; the assessed impact is confidentiality-only, with no data modification or service disruption. This issue is not confirmed actively exploited (CISA KEV), no public exploit identified at time of analysis, and EPSS is low at 0.82% (56th percentile). The primary limiting factor is the required authenticated session, and versions at or above 2024 SU5 are not affected.
Authenticated SQL injection in Ivanti Endpoint Manager 2024 through SU3 allows a remote attacker with valid EPM credentials to read arbitrary data from the product database, potentially exposing sensitive endpoint management records. The issue is fixed in 2024 SU5, but exploitation requires an existing login and no public exploit or CISA KEV activity is identified; EPSS is 0.82% (56th percentile), indicating limited real-world urgency.
SQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary data from the underlying database. The flaw affects Ivanti Endpoint Manager 2024 and its service updates up through SU3 (including SU3 security release 1) - any build prior to 2024 SU5. Exploitation requires valid low-privileged credentials (CVSS PR:L) and no user interaction, and the impact is limited to confidentiality (C:H/I:N/A:N), meaning data disclosure only with no ability to alter records or disrupt availability. No public exploit code has been identified and the CVE is not listed in CISA KEV; EPSS is low at 0.83% (56th percentile), so risk is driven primarily by the authentication prerequisite and the medium 6.5 severity.
SQL injection in Ivanti Endpoint Manager affects releases from 2024 through 2024 SU3 Security Release 1, allowing a remote attacker who holds valid EPM credentials to read arbitrary data from the underlying database; no user interaction is required and the flaw is network-reachable at low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, with no ability to modify data or disrupt service. The credential prerequisite (PR:L) is the principal limiting factor, so meaningful risk arises mainly where low-privileged EPM accounts are widely provisioned or where credentials can be obtained via reuse, phishing, or a separate intrusion path. EPSS is 0.83% (56th percentile), no public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); Ivanti has released a fix in version 2024 SU5.
SQL injection in Ivanti Endpoint Manager (all versions prior to 2024 SU5) allows an authenticated remote attacker with low-privilege credentials to read arbitrary data from the backend database. The vulnerability is post-authentication, requiring a valid EPM account, and impact is confined to confidentiality (read-only) with no modification or denial of service. No public exploit code has been identified at time of analysis, and EPSS score is 0.83% (56th percentile); however, because the flaw is network-reachable and low-complexity, it should be prioritized for patching, especially in internet-exposed deployments.
Remote code execution in Ivanti Endpoint Manager before version 2024 SU4 is achievable via a path-traversal flaw (CWE-22) that allows an unauthenticated remote attacker to escape intended directories and execute code on the EPM server, though the attack requires user interaction (UI:R) and thus cannot be fully autonomous. Affected versions include 2024, 2024 SU1, SU2, SU3, and SU3 Security Release 1, all fixed by upgrading to 2024 SU4. With an EPSS score of 15.33% (97th percentile) and no public exploit code or confirmed active exploitation identified at time of analysis, this is assessed as a high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Local privilege escalation in Ivanti Endpoint Manager allows an authenticated low-privilege attacker to gain high-integrity control of the host by feeding attacker-controlled serialized data into a vulnerable deserialization path in the EPM software. Affected builds are all EPM versions prior to 2024 SU4, specifically the 2024 base release and service updates SU1, SU2, SU3, and SU3 Security Release 1; systems already on 2024 SU4 or later are not affected. The attack requires an existing local authenticated session (PR:L, AV:L, no user interaction) and is not remotely reachable by an unauthenticated attacker; no public exploit identified at time of analysis, and EPSS is low at 0.78% (55th percentile), so this is a credible but not emergency-tier priority for most environments.
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
A security vulnerability in the agent of Ivanti Endpoint Manager (CVSS 8.4) that allows a local authenticated attacker. High severity vulnerability requiring prompt remediation.
A security vulnerability in the agent of Ivanti Endpoint Manager (CVSS 8.4) that allows a local authenticated attacker. High severity vulnerability requiring prompt remediation.
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 30.3% and no vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 26.5% and no vendor patch available.
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 43.8% and no vendor patch available.
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 21.5%.
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.