SQL injection in Ivanti EPM
Priority HIGH 71CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.68461 99th percentileScored 2026-11-07
Fix Fixed EPM (Ivanti): 2024 November Security Update, 2022 SU6 November Security Update
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ivanti | EPM | 2024 November Security Update to before 2024 November Security Update; 2022 SU6 November Security Update to before 2022 SU6 November Security Update | 2024 November Security Update, 2022 SU6 November Security Update | Patch available | CNA |
- EPM VendorIvanti Affected 2024 November Security Update to before 2024 November Security Update; 2022 SU6 November Security Update to before 2022 SU6 November Security Update Fixed in 2024 November Security Update, 2022 SU6 November Security Update Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* | before 2022 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* | 2022 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* | 2022 su1 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* | 2022 su2 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* | 2022 su3 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:* | 2022 su4 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:* | 2022 su5 | Vulnerable | Ivanti |
| cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* | 2024 | Vulnerable | Ivanti |
- cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* Versions before 2022 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* Versions 2022 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* Versions 2022 su1 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* Versions 2022 su2 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* Versions 2022 su3 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:* Versions 2022 su4 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:* Versions 2022 su5 Vulnerable ·Ivanti
- cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* Versions 2024 Vulnerable ·Ivanti
Remediation
- Fix · CNA EPM (Ivanti) Fixed in 2024 November Security Update, 2022 SU6 November Security Update
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ivanti EPM 2022 SU6 November Security Update, 2024 November Security Update
9 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 6 LOW
Other records, highest priority first
- TI-2024-21714 SQL injection in Ivanti EPMPriority MEDIUM 40
- TI-2024-21712 SQL injection in Ivanti EPMPriority MEDIUM 40
- TI-2024-24884 SQL injection in Ivanti EPMPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34781
- 2026-10-03 Alias added: GHSA-5g36-2x7r-j898
References
More Ivanti Endpoint Manager vulnerabilities
- TI-2024-12207 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
- TI-2024-12206 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
- TI-2024-12205 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
- TI-2024-19600 SQL injection in Ivanti EPM KEVCVSS 3.1HIGH 8.8
- TI-2026-01290 Authentication bypass in Ivanti Endpoint Manager KEVCVSS 3.1HIGH 8.6
- TI-2024-19602 SQL injection in Ivanti EPM CVSS 3.1HIGH 8.8
Sources
- CVE-2024-34781 · CVE Program
- CVE-2024-34781 · NVD
- FIRST EPSS
- GHSA-5g36-2x7r-j898 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences