Ivanti fixed a maximum severity flaw in its EPM software

CVE-2024-29847 is a deserialization of untrusted data flaw (CWE-502) in the agent portal of Ivanti Endpoint Manager (EPM). A remote, unauthenticated attacker can send maliciously crafted serialized data to the agent portal, and processing of that input results in remote code execution on the EPM server. Because EPM core servers typically hold privileged roles in enterprise Windows environments, successful exploitation could provide a foothold for broader network compromise. Organizations running EPM before the 2022 SU6 release, or before the 2024 September update, are affected. The flaw was patched in September 2024 with no public PoC or confirmed in-the-wild exploitation yet, but its high EPSS (52.9%, 99th percentile) suggests exploitation is likely within 30 days, and it arrives amid separate active exploitation of other Ivanti products (the Cloud Service Appliance), raising attacker interest in Ivanti software generally.

Do: Upgrade to Ivanti EPM 2022 SU6 if on the 2022 release line, or apply the September 2024 update if on the 2024 line. Restrict network access to the EPM agent portal to trusted management segments and review EPM servers for signs of compromise given the current attention on Ivanti products. Review Ivanti's September 2024 EPM advisory for additional vulnerabilities fixed at the same time.

Ivanti Endpoint Manager (EPM) contains an unauthenticated SQL injection flaw (CWE-89) in its management console that allows a remote attacker to achieve remote code execution on the EPM core server. The flaw is reachable over the network with no authentication and no user interaction, so anyone who can reach the console — including via the internet where it is exposed — can trigger it. Successful exploitation yields full code execution with high confidentiality, integrity, and availability impact, consistent with the critical 9.8 CVSS score. Organizations running EPM before 2022 SU6, or EPM 2024 before the September 2024 update, are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known (not in CISA KEV), but the 20.3% EPSS score (97th percentile) points to an elevated probability of exploitation within 30 days.

Do: Upgrade EPM to 2022 SU6, or apply the September 2024 update if running EPM 2024. Until patched, remove internet exposure of the EPM management console or restrict it to trusted management networks/VPN. With no public PoC available, prioritize patching and exposure reduction while monitoring the console for anomalous requests.