CVE-2024-13162: Ivanti EPM SQL injection leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw yields remote code execution on a central endpoint management server, but exploitation requires an existing admin account, which lowers the immediate risk compared with unauthenticated flaws.

What it is

Ivanti Endpoint Manager contains a SQL injection flaw that lets a remote authenticated attacker with admin privileges achieve remote code execution. It is an incomplete fix for CVE-2024-32848, so the earlier patch does not fully close the issue. Because the affected product is an endpoint management platform, successful exploitation can compromise the management server and the endpoints it controls.

Impact

An attacker with admin privileges gains remote code execution on the EPM server, allowing full control of that host and potentially the managed endpoint fleet. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but it requires high privileges (PR:H), meaning the attacker must already hold an admin account on the EPM instance. No other preconditions are described in the record.

Exploitation

CISA KEV does not list this CVE, and the only reference is the vendor advisory, so there is no public evidence of active exploitation in this record. EPSS is high at 0.64176 (99.19th percentile), indicating elevated predicted likelihood of exploitation.

What to do

• Apply the Ivanti EPM January-2025 Security Update for EPM 2024 or the 2022 SU6 January-2025 Security Update, which addresses the incomplete fix from CVE-2024-32848.
• Restrict and audit admin-level accounts on EPM; the flaw requires admin privileges, so reducing and monitoring privileged access limits exposure.
• Limit network access to the EPM server to trusted management networks rather than exposing it broadly.
• Review and rotate credentials for EPM admin accounts if compromise is suspected, since RCE on the server can expose stored secrets.

Detection

• Monitor EPM server and database logs for anomalous SQL statements or errors consistent with injection attempts.
• Alert on unexpected child processes or command execution spawned by the EPM application or its database service.
• Audit EPM admin account activity for unusual logins, queries or configuration changes.
• Watch for outbound connections from the EPM server to unfamiliar hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.