CVE-2024-29822

What it actually does

CVE-2024-29822 is an unauthenticated SQL injection flaw in the Ivanti Endpoint Manager (EPM) Core server affecting EPM 2022 SU5 and earlier. An attacker with network-level access to the Core server can send crafted requests that alter backend SQL queries. Because the vulnerable path can lead to arbitrary code execution, successful exploitation may allow the attacker to execute commands in the context of the EPM application, database service account, or related Core server components. The impact includes full compromise of confidentiality, integrity, and availability for the EPM Core server and potentially systems managed by EPM.

Why it matters to the business

A compromised EPM Core server is high impact because EPM is commonly used to manage endpoints, deploy software, run administrative tasks, and maintain device inventory. An attacker who gains code execution on this server may be able to steal management data, tamper with endpoint configurations, disrupt endpoint operations, or use the platform’s privileged management role to move laterally across the internal network. Although this issue requires same-network access rather than direct internet exposure, the high CVSS score and elevated EPSS probability indicate meaningful exploitation risk for organizations where EPM is reachable from user, VPN, wireless, or partner network segments.

How an attack unfolds

An attacker first obtains network connectivity to the Ivanti EPM Core server, such as from an internal workstation, VPN connection, compromised host, or poorly segmented adjacent network. The attacker identifies EPM services exposed on the Core server and sends specially crafted unauthenticated requests containing SQL syntax designed to manipulate backend database queries. If the server is vulnerable, the injected SQL executes in the database context used by EPM. From there, the attacker may enumerate database contents, modify application state, abuse database features, or trigger the application path that results in arbitrary code execution. After code execution is achieved, the attacker can establish persistence, collect credentials and EPM secrets, stage tools, pivot to other internal systems, or abuse EPM’s endpoint-management capabilities to affect managed devices.

How to fix it

Upgrade Ivanti Endpoint Manager to a vendor-fixed release immediately. EPM 2022 SU5 and earlier are affected; deploy Ivanti’s fixed service update for this vulnerability, such as EPM 2022 SU6 or later if applicable to the installed branch, or move to the latest supported Ivanti EPM release. If immediate upgrade is not possible, restrict access to the EPM Core server to only required administrative and management networks, block access from user and VPN segments where feasible, enforce host firewall rules, and monitor for SQL injection attempts and unexpected command execution. Review EPM service accounts and database permissions to ensure least privilege, disable unnecessary database features that allow OS command execution, and rotate credentials if compromise is suspected.

How to confirm the fix worked

Confirm the installed Ivanti EPM version is newer than EPM 2022 SU5 and includes Ivanti’s fix for CVE-2024-29822. Validate patch status from the EPM console, installed product version, service update level, and vendor patch inventory. Perform a network exposure review to ensure only authorized administrative or management subnets can reach EPM Core services. If using a vulnerability scanner, verify it detects the exact EPM build or service update rather than relying only on banner information. After remediation, review application and database logs for failed or blocked SQL injection probes and confirm that EPM services do not show SQL errors or timing anomalies when tested with safe, non-destructive validation checks.

Typical attack path

1. Gain network access to the same logical network or routed segment as the Ivanti EPM Core server.
2. Discover the EPM Core server and exposed application or service ports.
3. Send unauthenticated requests containing SQL injection payloads to the vulnerable Core server component.
4. Use SQL injection to confirm execution through errors, timing behavior, or observable application responses.
5. Escalate from database query manipulation to arbitrary code execution through the vulnerable server-side workflow or database/application execution primitives.
6. Run reconnaissance commands, dump sensitive data, or create/modify privileged application state.
7. Deploy persistence, credential-theft tooling, or remote access tools on the Core server.
8. Use the compromised EPM server as a pivot point or abuse endpoint-management functions to reach managed systems.

How to detect it

To determine whether this was already exploited, review EPM Core server application logs, web/API access logs, SQL Server logs, Windows Security event logs, Sysmon or EDR telemetry, PowerShell logs, scheduled task logs, and firewall/VPN logs showing access to the Core server. Look for unauthenticated requests containing SQL metacharacters, stacked queries, comment markers, time-delay functions, UNION queries, or SQL Server extended procedure references. Correlate these requests with SQL errors, unusual database logins, unexpected changes to EPM configuration, new administrative users, abnormal endpoint deployment jobs, or unusual inventory/task activity. On the Core server and database host, hunt for process creation events where EPM services, IIS worker processes, or sqlservr.exe spawn cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, or other living-off-the-land tools. Also check for newly created scheduled tasks, services, startup items, unknown binaries in writable web/application directories, suspicious outbound connections from the EPM Core server, and credential-access behavior. Because the vulnerability details are unspecified, detections should combine generic SQL injection payload indicators with host-based evidence of post-exploitation command execution.

• UNION SELECT
• UNION ALL SELECT
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• xp_cmdshell
• sp_configure
• OPENROWSET
• INFORMATION_SCHEMA
• sys.objects
• sys.databases
• '--
• "--
• /*
• */
• ;--
• OR 1=1
• AND 1=1
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• sqlservr.exe spawned cmd.exe
• sqlservr.exe spawned powershell.exe
• w3wp.exe spawned cmd.exe
• w3wp.exe spawned powershell.exe
• C:\Program Files\LANDesk\ManagementSuite\

What your security team should do

• Prioritize patching of all Ivanti EPM Core servers running EPM 2022 SU5 or earlier because the vulnerability permits unauthenticated code execution from the same network and has a high EPSS score.
• Treat EPM Core servers as high-value administrative infrastructure; place them in a restricted management segment and deny access from general user, guest, wireless, and broad VPN networks.
• Review whether EPM services are exposed beyond intended internal management networks, including through VPN, NAT, firewall exceptions, or monitoring integrations.
• Enable or increase logging for EPM application requests, web/API access, SQL Server activity, Windows process creation, and PowerShell execution on the Core server.
• Hunt for evidence of SQL injection attempts, database feature abuse, unexpected child processes, new administrative users, suspicious scheduled tasks, web shells, or endpoint-deployment actions originating from the EPM server.
• If exploitation is suspected, isolate the EPM Core server, preserve forensic evidence, rotate EPM, database, service-account, and local administrator credentials, and review managed endpoints for suspicious deployments or commands.
• Add detections for SQL injection payloads and for EPM or SQL Server processes spawning command interpreters or scripting engines.
• Continuously verify that EPM service accounts and database roles do not have unnecessary privileges that would amplify SQL injection impact.