CVE-2024-29825: Ivanti EPM Core server SQL injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 8.8 with adjacent unauthenticated code execution and very high EPSS make this a high-priority patch despite no KEV listing.

What it is

Ivanti Endpoint Manager 2022 SU5 and earlier contain an unspecified SQL injection in the Core server. The flaw is reachable by an unauthenticated attacker on the same network and can lead to arbitrary code execution. It matters because EPM is a management server, so compromise can expose managed endpoints and credentials.

Impact

An attacker gains arbitrary code execution on the Core server, with high impact to confidentiality, integrity and availability. This can lead to full control of the EPM server and the endpoints it manages.

Attack surface

The vector is adjacent network (AV:A), no privileges (PR:N) and no user interaction (UI:N), so an attacker on the same network segment can reach the vulnerable service directly. No authentication is required.

Exploitation

The record shows no CISA KEV listing and no public exploit references, but EPSS is very high (0.99877, 99.964th percentile), indicating elevated predicted exploitation activity. No ransomware group use is documented.

What to do

• Apply the Ivanti security advisory May 2024 update for EPM 2022 SU5 and prior as the first action.
• Restrict network access to the EPM Core server so only trusted management hosts and administrators can reach it.
• Segment the EPM server from general user and endpoint networks to reduce adjacent-network exposure.
• Monitor for and investigate unexpected processes, database queries or outbound connections originating from the EPM Core server.
• If patching is delayed, consider temporary network isolation or access control changes for the EPM Core server.

Detection

• Monitor EPM Core server logs and database logs for anomalous SQL queries or injection-like patterns.
• Alert on unexpected child processes or command execution spawned by the EPM Core server service.
• Track network connections to the EPM Core server from non-management hosts or unusual internal segments.
• Review EPM server file system and registry changes for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.