Read the docs
TI-2023-17548 Aliases CVE-2023-35077GHSA-gqrc-7g2r-3f7c

Out-of-bounds write in Ivanti Endpoint Manager

Priority MEDIUM 43CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02213 82nd percentileScored 2026-11-07
Fix Fixed Endpoint Manager (Ivanti): 7.9.1.285

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiEndpoint Manager7.9.1.285 to before 7.9.1.2857.9.1.285Patch availableCNA
  • Endpoint Manager VendorIvanti Affected 7.9.1.285 to before 7.9.1.285 Fixed in 7.9.1.285 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*before 7.9.1.285VulnerableIvanti
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* Versions before 7.9.1.285 Vulnerable ·Ivanti
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Endpoint Manager (Ivanti) Fixed in 7.9.1.285

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35077
  2. 2026-10-03 Alias added: GHSA-gqrc-7g2r-3f7c

References

Advisory 1

  • TI-2024-12207 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12206 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12205 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-19600 SQL injection in Ivanti EPM KEVCVSS 3.1HIGH 8.8
  • TI-2026-01290 Authentication bypass in Ivanti Endpoint Manager KEVCVSS 3.1HIGH 8.6
  • TI-2024-19602 SQL injection in Ivanti EPM CVSS 3.1HIGH 8.8
See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences