Read the docs
TI-2023-12872 Aliases CVE-2023-28324GHSA-g9xm-xhj6-2frv

Improper input validation in Ivanti Endpoint Manager

Priority HIGH 76CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.12904 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiIvanti Endpoint Manager2022 – 2022—No fix listedCNA
  • Ivanti Endpoint Manager VendorIvanti Affected 2022 – 2022 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*up to 2022VulnerableIvanti
  • cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* Versions up to 2022 Vulnerable ·Ivanti

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28324
  2. 2026-10-03 Alias added: GHSA-g9xm-xhj6-2frv

References

Advisory 1

  • TI-2024-12207 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12206 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12205 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-19600 SQL injection in Ivanti EPM KEVCVSS 3.1HIGH 8.8
  • TI-2026-01290 Authentication bypass in Ivanti Endpoint Manager KEVCVSS 3.1HIGH 8.6
  • TI-2024-19602 SQL injection in Ivanti EPM CVSS 3.1HIGH 8.8
See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences