Ivanti Endpoint Manager (EPM) Core Server Unauthenticated Remote Code Execution Vulnerability Advisory (CVE-2024-29824)
Executive & SecOps Summary
SECOPS ASSESSMENTIvanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)
Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges
Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official Ivanti EPM 2022 SU6 update or later. Ensure a full backup of the Core Server and the associated database is taken before applying the patch.
2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict network access to the Core Server using firewalls, allowing only trusted administrative subnets. Additionally, ensure that xp_cmdshell is disabled on the backend MSSQL database.
-- Disable xp_cmdshell on the backend MSSQL database
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;3. Log Audit & IoC Verification Commands
Audit IIS logs and MSSQL error logs for suspicious SQL syntax (e.g., 'UNION', 'xp_cmdshell', 'sp_OACreate'). Use the following PowerShell script to verify the installed version of Ivanti EPM on the Core Server.
# PowerShell script to check installed Ivanti EPM version
$RegistryPath = 'HKLM:\SOFTWARE\LANDesk\ManagementSuite\Setup'
if (Test-Path $RegistryPath) {
$Version = Get-ItemProperty -Path $RegistryPath -Name 'Version' -ErrorAction SilentlyContinue
Write-Output 'Installed Ivanti EPM Version: ' $Version.Version
} else {
Write-Output 'Ivanti EPM registry key not found.'
}Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-29824) is an unauthenticated SQL Injection vulnerability residing in the Core Server of Ivanti Endpoint Manager (EPM). The root cause is the lack of proper input validation and parameterized queries when handling specific incoming network requests. This allows an attacker to inject malicious SQL commands directly into the database execution flow.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the Ivanti EPM Core Server can send specially crafted HTTP requests containing malicious SQL payloads. In environments utilizing Microsoft SQL Server (MSSQL) as the backend database, this SQL injection can be leveraged to invoke extended stored procedures such as xp_cmdshell, leading to arbitrary operating system command execution under the context of the database service account.
3. Infrastructure & Business Impact
Ivanti EPM is a centralized endpoint management solution. Compromising the Core Server grants the attacker absolute control over the entire managed infrastructure, enabling lateral movement, malware deployment, and ransomware execution across all managed endpoints. This vulnerability is actively exploited in the wild (listed in CISA KEV) and has an EPSS score of 0.9994, representing an extreme risk.
Official Vendor Advisories & References
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Frequently Asked SecOps Questions (CVE-2024-29824)
FAQQ1. How critical is CVE-2024-29824 and is it actively exploited in the wild?
CVE-2024-29824 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-29824?
Primary impacted vendors include ivanti across epm, endpoint_manager. Scope summary: Ivanti Endpoint Manager (EPM) 2022 SU5 and prior versions
Q3. What temporary mitigations or workarounds exist for CVE-2024-29824 before patching?
[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-29824
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ivanti)
View Category →Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)
[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.