An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Confirm exposure before applying a vendor-supported change.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due date: 2024.10.23Confirm that Ivanti Endpoint Manager (EPM) and an affected version are present.
Combine exploitation signals with asset exposure and business criticality.
Follow the vendor advisory or supported update path and preserve rollback options.
Recheck the version, service health, access paths, and relevant logs.
