CVE-2024-29826

What it actually does

CVE-2024-29826 is an unauthenticated SQL injection vulnerability in the Ivanti Endpoint Manager Core server affecting Ivanti EPM 2022 SU5 and earlier. An attacker with network-level access to the Core server can send crafted requests that alter backend SQL queries. Because the flaw is reachable without authentication and can lead to arbitrary code execution, successful exploitation may allow the attacker to read or modify database contents, execute operating-system commands through database or application-layer execution paths, and potentially take control of the EPM Core server. The CVSS score of 9.6 reflects high confidentiality, integrity, and availability impact with low attack complexity, though the attack vector is adjacent/network-limited rather than broadly internet-routable in the CVSS vector.

Why it matters to the business

Compromise of an Ivanti EPM Core server can have serious operational consequences because EPM systems commonly manage endpoints, software distribution, patching, inventory, and administrative workflows. An attacker who gains control of the Core server may be able to disrupt endpoint management, tamper with software or patch deployment processes, access sensitive asset and configuration data, and use the management server as a platform for lateral movement. Although this issue is not listed in CISA KEV and no ransomware use is indicated in the provided data, the EPSS score is extremely high, meaning exploitation is statistically likely in the wild or highly attractive to attackers. Organizations should treat exposed or broadly reachable EPM Core servers as high-priority remediation targets.

How an attack unfolds

An attacker first needs network reachability to the Ivanti EPM Core server, such as access from the same internal network, VPN, compromised workstation, partner connection, or another adjacent segment. The attacker identifies the Core server and probes exposed EPM services or web/API endpoints for SQL injection behavior using crafted parameters, quote characters, boolean conditions, time delays, or stacked query techniques. Once a vulnerable request path is found, the attacker uses SQL injection to enumerate the backend database, extract sensitive data, alter records, or escalate the injection into command execution if the database or application context allows it. In a successful end-to-end compromise, the attacker may execute commands on the Core server, deploy web shells or tooling, create persistence through services or scheduled tasks, harvest credentials or configuration secrets, and pivot to managed endpoints or other internal systems.

How to fix it

Apply the vendor-provided Ivanti EPM update or hotfix that addresses CVE-2024-29826. The affected range is Ivanti EPM 2022 SU5 and earlier; systems should be upgraded to a fixed release later than SU5 or to the latest supported Ivanti EPM service update. If an immediate upgrade is not possible, restrict network access to the EPM Core server to only required administrative subnets and trusted management hosts, block access from general user VLANs and VPN pools where feasible, and enforce segmentation around SQL Server and EPM services. Review database permissions used by the EPM application and remove unnecessary high-risk capabilities such as command-execution features where not required. Ensure EPM Core server and database backups are current before patching, and rotate credentials that may have been exposed if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Ivanti EPM version and service update level and verify it is newer than EPM 2022 SU5 or otherwise explicitly listed by Ivanti as fixed for CVE-2024-29826. Validate that the vulnerable Core server is no longer reachable from untrusted internal networks, broad VPN ranges, guest networks, or unnecessary adjacent segments. Review change control or package inventory to confirm the hotfix/service update was applied successfully on all Core servers. After patching, perform a safe authenticated configuration review and, where permitted, a controlled vulnerability scan using an updated scanner signature for this CVE. Avoid destructive proof-of-concept testing in production; instead, use vendor guidance, scanner checks, version verification, and log review to validate remediation.

Typical attack path

1. Gain network access to a segment that can reach the Ivanti EPM Core server.
2. Identify Ivanti EPM Core services, web interfaces, API endpoints, or management ports exposed on that network.
3. Send crafted unauthenticated requests containing SQL metacharacters, boolean logic, time-delay payloads, or stacked-query probes.
4. Confirm SQL injection through response differences, SQL error messages, delayed responses, or data leakage.
5. Use the SQL injection to enumerate database structure and extract sensitive EPM data or credentials.
6. Attempt to escalate from SQL injection to operating-system command execution through available database/application mechanisms.
7. Establish persistence by creating files, services, scheduled tasks, database objects, or administrative accounts where possible.
8. Use the compromised EPM server to move laterally, tamper with endpoint management workflows, or stage additional payloads.

How to detect it

To determine whether exploitation already occurred, review Ivanti EPM Core server logs, web/API access logs if present, Windows Event Logs, SQL Server error logs, SQL Server audit logs, EDR telemetry, firewall logs, and NetFlow for suspicious activity. Look for unauthenticated requests containing SQL injection patterns, repeated malformed parameters, HTTP 500 errors correlated with database errors, time-delay probes, and scanner-style request bursts. On SQL Server, investigate evidence of dangerous feature enablement, command execution, new logins, altered database roles, suspicious SQL Agent jobs, unusual stored procedures, and queries using UNION SELECT, WAITFOR DELAY, stacked statements, or xp_cmdshell. On the Core server, look for EPM or SQL Server service processes spawning command interpreters or script engines, unexpected file creation in web/application directories or temporary directories, newly created services and scheduled tasks, credential dumping tools, remote access tooling, and outbound connections to unfamiliar internal or external hosts. Correlate suspicious database activity with endpoint process creation around the same timestamps. Because no CVE-specific public exploit path or fixed endpoint detail is provided in the input, detections should combine generic SQL injection telemetry with host-based post-exploitation indicators on Ivanti EPM and SQL Server systems.

• UNION SELECT
• UNION ALL SELECT
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• xp_cmdshell
• sp_configure 'xp_cmdshell'
• sp_configure "xp_cmdshell"
• Ole Automation Procedures
• sp_OACreate
• INFORMATION_SCHEMA.TABLES
• INFORMATION_SCHEMA.COLUMNS
• sys.objects
• sys.sql_logins
• OR 1=1
• ' OR '1'='1
• " OR "1"="1
• ;--
• sqlmap
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• mshta.exe http
• rundll32.exe javascript:
• wscript.exe
• cscript.exe
• schtasks /create
• sc.exe create
• net user /add
• net localgroup administrators
• xp_cmdshell 'whoami'
• xp_cmdshell "whoami"
• WAITFOR DELAY '0:0:5'
• WAITFOR DELAY '00:00:05'

What your security team should do

• Patch or upgrade Ivanti EPM Core servers running 2022 SU5 or earlier as an emergency/high-priority action.
• Immediately restrict network paths to EPM Core servers so only required administrators, management systems, and trusted service accounts can connect.
• Hunt for signs of SQL injection and post-exploitation activity on EPM Core servers, SQL Server hosts, and adjacent network telemetry for at least the period since publication if logs are available.
• Review SQL Server configuration for risky features such as xp_cmdshell, OLE Automation Procedures, suspicious SQL Agent jobs, new database users, altered roles, and unexpected stored procedures.
• Inspect the EPM Core server for new services, scheduled tasks, web-accessible files, unusual scripts, credential dumping tools, remote access tools, or unexpected administrative accounts.
• Rotate EPM-related database, service account, and administrative credentials if exploitation cannot be ruled out.
• Increase monitoring of the EPM Core server for child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, or bitsadmin.exe spawned by EPM or SQL Server services.
• Place EPM Core servers in a tightly controlled management network and remove direct reachability from general workstation networks.
• Ensure backups of EPM and SQL Server components are available, protected from tampering, and tested for restoration.
• Track Ivanti advisories for updated fixed-version information, mitigations, and any subsequent exploitation details.