CVE-2024-29826: Ivanti EPM Core server SQL injection allows unauthenticated code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityPre-auth adjacent-network code execution with a very high EPSS score and no KEV listing, warranting urgent patching and network restriction.

What it is

The Core server of Ivanti Endpoint Manager 2022 SU5 and earlier contains an unspecified SQL injection vulnerability. An unauthenticated attacker on the same network can exploit it to execute arbitrary code, making it a serious pre-auth risk for exposed EPM servers.

Impact

An attacker gains arbitrary code execution on the Core server, which can lead to full compromise of the EPM management infrastructure and any endpoints it controls.

Attack surface

Reachable over the adjacent network (AV:A) with no authentication (PR:N) and no user interaction (UI:N), so any host on the same network segment can attempt exploitation.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references beyond the vendor advisory, but EPSS is very high (0.99877, 99.96th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Ivanti security advisory May 2024 update to EPM 2022 SU5 and prior as soon as possible.
• Restrict network access to the EPM Core server so only trusted management hosts can reach it.
• Segment EPM management traffic away from general user and guest networks.
• Monitor Ivanti advisories for follow-up patches or updated guidance.
• If patching is delayed, consider temporary network-level filtering of access to the Core server.

Detection

• Review Core server and database logs for anomalous SQL queries or errors consistent with injection attempts.
• Alert on unexpected processes or child processes spawned by the EPM Core server service.
• Monitor for unusual outbound or lateral connections originating from the EPM Core server.
• Baseline normal Core server network peers and alert on new or unauthorized source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.