CVE-2024-37397: Ivanti EPM provisioning web service XXE leaks API secrets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote XXE with high confidentiality impact and very high EPSS, though no KEV listing or known exploitation is recorded.

What it is

Ivanti Endpoint Manager (EPM) before 2022 SU6 and the 2024 September update contain an XML external entity (XXE) flaw in the provisioning web service. A remote attacker can send crafted XML to make the service resolve external entities and disclose API secrets. Because the exposed secrets can grant access to other EPM functions, the flaw matters beyond the initial information leak.

Impact

An unauthenticated attacker gains disclosure of API secrets used by the EPM provisioning service. Those secrets can enable follow-on access to EPM APIs and related management functions, though the record does not detail the full downstream impact.

Attack surface

Reachable over the network through the provisioning web service; the CVSS vector shows no privileges and no user interaction required. Any host that can reach the service can attempt the attack.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is recorded in the references. EPSS is high (0.59257, 99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the Ivanti EPM 2022 SU6 or 2024 September update per the vendor advisory.
• If patching cannot be done immediately, restrict network access to the provisioning web service to trusted management hosts only.
• Disable external entity resolution in the XML parser used by the provisioning service where configuration allows.
• Rotate any API secrets or credentials that the provisioning service may have exposed.
• Monitor the vendor advisory for updated guidance and affected build details.

Detection

• Inspect provisioning web service request logs for XML payloads containing DOCTYPE declarations or SYSTEM/PUBLIC entity references.
• Alert on outbound connections from the EPM server to unexpected internal or external hosts following provisioning requests.
• Review EPM API access logs for use of secrets from unusual source addresses or at unusual times.
• Baseline normal provisioning traffic and flag anomalous XML body sizes or structures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.