Vulnerability record · CVE-2024-29822 · published 31 May 2024
CVE-2024-29822: Ivanti EPM Core server SQL injection allows unauthenticated code execution
Ivanti · Endpoint Manager
The Core server of Ivanti Endpoint Manager 2022 SU5 and earlier contains an unspecified SQL injection (CWE-89). Because the flaw is reachable without authentication from the adjacent network and can lead to arbitrary code execution, it is a serious pre-auth risk for exposed EPM servers.
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityPre-auth adjacent-network SQL injection leading to code execution with a very high EPSS score, though not yet in KEV and no confirmed public exploit.
What it is
The Core server of Ivanti Endpoint Manager 2022 SU5 and earlier contains an unspecified SQL injection (CWE-89). Because the flaw is reachable without authentication from the adjacent network and can lead to arbitrary code execution, it is a serious pre-auth risk for exposed EPM servers.
Impact
An unauthenticated attacker on the same network can execute arbitrary code on the Core server, gaining full control of confidentiality, integrity and availability of that host.
Attack surface
Reached over the adjacent network (AV:A) with no privileges and no user interaction required, per the CVSS vector. The description does not specify which endpoint or parameter is vulnerable.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.6439 (99.2nd percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Apply the Ivanti security advisory May 2024 update for EPM (upgrade beyond 2022 SU5) as the primary fix.
- Restrict network access to the EPM Core server so only trusted management subnets and hosts can reach it.
- Segment EPM servers from general user and workstation networks to limit adjacent-network reach.
- Monitor Ivanti advisories for follow-up patches and any revised affected-version guidance.
- Where patching is delayed, add compensating controls such as firewall rules and enhanced logging on the Core server.
Detection
- Review EPM Core server logs and database query logs for anomalous or malformed SQL statements.
- Alert on unexpected child processes or command execution spawned by the EPM Core server service.
- Monitor for unusual inbound connections to EPM Core server ports from non-management hosts.
- Correlate EPM server activity with outbound connections or file writes that deviate from baseline.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advisory-May-2024 | Vendor Advisory |
| https://forums.ivanti.com/s/article/Security-Advisory-May-2024 | Vendor Advisory |
Track CVE-2024-29822 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-29822), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
