CVE-2024-29823: Ivanti Endpoint Manager Core Server SQL Injection Allows Unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityUnauthenticated adjacent-network code execution in a management server with an EPSS score near 1.0 makes this an urgent patch-first issue.

What it is

Ivanti Endpoint Manager 2022 SU5 and earlier contain an unspecified SQL injection in the Core server. An unauthenticated attacker on the same network can exploit it to execute arbitrary code. The flaw is high severity and trivially reachable from an adjacent network position.

Impact

Successful exploitation gives the attacker arbitrary code execution on the Core server, likely with the privileges of the service. That can lead to full compromise of the EPM management plane and any managed endpoints.

Attack surface

The vulnerability is in the Core server and is reachable over an adjacent network (AV:A) with no authentication (PR:N) and no user interaction (UI:N). An attacker only needs network access to the EPM Core server, not credentials.

Exploitation

The record shows no CISA KEV listing and no public exploit references, but EPSS is 0.9986 (99.9th percentile), indicating a very high predicted likelihood of exploitation in the next 30 days.

What to do

• Apply the Ivanti security advisory May 2024 update for Endpoint Manager immediately; upgrade beyond 2022 SU5.
• Restrict network access to the EPM Core server to trusted management hosts and segments; do not expose it broadly.
• Segment EPM infrastructure from general user networks to limit adjacent-network attack paths.
• Monitor Ivanti advisories for follow-up patches and interim guidance.
• If patching is delayed, consider temporary network-level filtering of untrusted traffic to the Core server.

Detection

• Monitor EPM Core server logs for anomalous SQL errors or unexpected database queries.
• Alert on unusual outbound connections or process creation from the EPM Core server service account.
• Hunt for signs of SQL injection attempts in network traffic to the Core server, such as malformed or unexpected query strings.
• Review EPM server logs for authentication bypass or unexpected administrative actions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.