CVE-2024-29827: Ivanti EPM Core server SQL injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated adjacent-network code execution with high EPSS and high CVSS impact, though not in KEV and no exploit details are provided.

What it is

An unspecified SQL injection in the Core server of Ivanti Endpoint Manager 2022 SU5 and prior lets an unauthenticated attacker on the same network execute arbitrary code. The flaw is remotely reachable without credentials, so it can be used to take over the management server that controls endpoints.

Impact

An attacker gains arbitrary code execution on the EPM Core server, which can lead to full compromise of the server and the managed endpoint fleet. The CVSS vector shows high confidentiality, integrity and availability impact.

Attack surface

Reached over the adjacent network (AV:A) with no privileges (PR:N) and no user interaction (UI:N), per the CVSS vector. The attacker must be positioned on the same network segment as the Core server.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.71685 (99.39th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the Ivanti security advisory update for EPM 2022 SU5 and prior as soon as possible.
• Restrict network access to the EPM Core server to trusted management segments and block untrusted adjacent-network traffic.
• Segment the EPM server from general user and endpoint networks to reduce exposure to same-network attackers.
• Monitor Ivanti advisories for updated fixed versions and confirm the installed build after patching.
• If patching cannot be immediate, isolate the Core server and limit inbound connections to required administrative hosts.

Detection

• Monitor EPM Core server logs and database query logs for anomalous SQL statements or injection patterns.
• Alert on unexpected child processes or command execution spawned by the EPM Core server service.
• Watch for unusual outbound or lateral network connections from the EPM server to other internal hosts.
• Review authentication and access logs for unauthenticated or unexpected requests to Core server endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.