CVE-2024-29824: Ivanti Endpoint Manager Core Server SQL Injection Enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is an unauthenticated, network-adjacent RCE in a management server, listed in CISA KEV with a near-maximum EPSS score.

What it is

Ivanti Endpoint Manager 2022 SU5 and earlier contains an unspecified SQL injection in the Core server. An unauthenticated attacker on the same network can exploit it to execute arbitrary code. The flaw is in CISA KEV and has a near-certain EPSS score, so it is a high-value target for defenders.

Impact

Successful exploitation lets an attacker run arbitrary code on the Core server, giving full control of the EPM management host. That host typically holds broad administrative reach over managed endpoints, so compromise can cascade across the estate.

Attack surface

The vector is adjacent network (AV:A) with no privileges or user interaction required, so an attacker already on the same network segment can reach the Core server directly. No authentication is needed.

Exploitation

CISA added it to KEV on 2024-10-02 with a 2024-10-23 remediation due date, and EPSS is 0.99951 (99.97th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

• Apply the Ivanti security advisory May 2024 update to EPM 2022 SU5 or later immediately; if patching is not possible, follow vendor mitigations or discontinue use per CISA guidance.
• Restrict network access to the EPM Core server so only trusted management hosts and administrators can reach it.
• Segment the EPM server from general user and endpoint networks to reduce adjacent-network exposure.
• Monitor for and block unexpected outbound or lateral traffic from the EPM Core server.
• Verify no unauthorized changes to EPM server configuration, scheduled tasks, or service accounts after patching.

Detection

• Review EPM Core server logs for anomalous SQL queries, errors, or unexpected database activity.
• Hunt for unusual process creation or command execution on the EPM Core server, especially spawned by database or web service processes.
• Monitor network flows to the EPM Core server for connections from unexpected internal hosts.
• Check for new or modified files, services, or scheduled tasks on the EPM server that could indicate post-exploitation persistence.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.