CVE Watch—

CVE-2024-29824

Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Oct 2, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

Ivanti / Endpoint Manager (EPM)

Vulnerability

Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

Added to KEV

Oct 2, 2024

Remediate by

Oct 23, 2024

Known ransomware use

Summary description

Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://forums.ivanti.com/s/article/Security-Advisory-May-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-29824

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-13159—

100.0%

KEV—80Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability—CVE-2024-13161—

99.8%

KEV—80Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability—CVE-2024-13160—

99.8%

KEV—80Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability—