CVE-2024-34783

CVE-2024-34783 is a SQL injection flaw (CWE-89) in Ivanti Endpoint Manager (EPM) that can be exploited by a remote, authenticated attacker holding administrator privileges, ultimately achieving remote code execution on the EPM core server. Because it requires network access plus high-level (admin) credentials, exploitation depends on an attacker first obtaining or compromising an administrator account, for example via credential theft or phishing. An attacker who succeeds gains full confidentiality, integrity, and availability impact on the server, and from an EPM core server can typically pivot to managed endpoints across the enterprise. Organizations running Ivanti EPM on versions before the 2022 SU6 release, or on 2024 versions without the September 2024 update, are affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known yet, but the EPSS score of 43.4% (99th percentile) indicates a materially elevated likelihood of exploitation within 30 days.

What to do: Upgrade EPM core servers to the 2022 SU6 release (2022 branch) or apply the September 2024 update (2024 branch) as soon as possible. In the interim, restrict network access to the EPM core server and its web/agent ports to trusted management segments, review administrator accounts for unusual or compromised credentials, and monitor EPM server logs for suspicious SQL or command-execution activity given the elevated EPSS score.