CVE-2024-29847

What it actually does

CVE-2024-29847 is an unauthenticated remote code execution vulnerability caused by unsafe deserialization in the Ivanti Endpoint Manager agent portal. A remote attacker can send crafted serialized data to the vulnerable portal and cause the server to instantiate attacker-controlled objects or execution paths. Successful exploitation can execute arbitrary commands with the privileges of the Ivanti EPM web/application service account, potentially leading to full compromise of the EPM server and downstream control over managed endpoints.

Why it matters to the business

Because Ivanti EPM is used to manage endpoints, software deployment, inventory, and administrative operations, compromise of the EPM server can become a high-impact enterprise intrusion path. An attacker who gains code execution may steal credentials, deploy malware through management tooling, tamper with endpoint configurations, or use the server as a pivot point into the internal network. The CVSS score is critical and the EPSS probability is elevated, indicating meaningful exploitation likelihood even though it is not currently listed in CISA KEV and no mature public exploit is noted in the supplied data.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Ivanti EPM agent portal running a vulnerable version prior to Ivanti EPM 2022 SU6 or prior to the 2024 September update. The attacker sends a crafted unauthenticated request containing malicious serialized data to the agent portal component. When the server deserializes the payload, attacker-controlled logic is triggered, resulting in command execution on the EPM server. The attacker may then run discovery commands, drop a web shell or remote access tool, harvest credentials from the server, and attempt lateral movement. Because EPM commonly has elevated operational reach over endpoints, a successful compromise may be used to distribute payloads or manipulate managed systems at scale.

How to fix it

Upgrade Ivanti Endpoint Manager to a fixed release immediately. Systems running Ivanti EPM before 2022 SU6 should be upgraded to 2022 SU6 or later; systems on the 2024 release line should apply the 2024 September update or later. If immediate patching is not possible, restrict access to the agent portal to trusted management networks or VPN-only access, block direct internet exposure, enforce network-layer allowlisting, and monitor the EPM server closely for web-service child process execution. Treat mitigation as temporary; the durable fix is applying the vendor update.

How to confirm the fix worked

Confirm the installed Ivanti EPM version and build level from the product console, server inventory, or vendor-supported version command and verify it is at least 2022 SU6 or includes the 2024 September update or later. Validate externally and internally that the agent portal is not reachable from untrusted networks unless explicitly required. Run an authenticated vulnerability scan or configuration assessment using a scanner plugin that checks CVE-2024-29847 or the relevant Ivanti EPM build. After patching, confirm the application services restarted successfully and review change records to ensure all EPM servers, including standby or secondary servers, were updated.

Typical attack path

1. Scan for exposed Ivanti Endpoint Manager agent portal services.
2. Fingerprint the service version or infer vulnerability from response behavior and patch level.
3. Send a crafted unauthenticated serialized payload to the vulnerable agent portal.
4. Trigger arbitrary command execution under the Ivanti EPM web/application service context.
5. Establish persistence, commonly through a web shell, scheduled task, service, or remote access tool.
6. Run host and domain discovery commands and collect credentials or tokens available to the EPM server.
7. Use the compromised management server to pivot laterally or affect managed endpoints.

How to detect it

Investigate Ivanti EPM web, application, Windows Event, Sysmon/EDR, proxy, and firewall logs for signs of unauthenticated requests to the agent portal followed by command execution. Focus on the sequence of inbound HTTP requests to the EPM agent portal, server-side errors related to deserialization, and child processes spawned by the web/application service such as cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. Review Windows Security Event ID 4688 or Sysmon Event ID 1 for suspicious process creation, Event ID 7045 for new services, scheduled task creation events, and unexpected file writes in web or application directories. Examine outbound network connections from the EPM server shortly after suspicious HTTP requests, especially connections initiated by command interpreters or scripting engines. Because no KEV listing or named threat actor context is supplied, detection should emphasize behavior-based evidence of exploitation rather than relying on known campaign-specific indicators.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> cscript.exe
• powershell -enc
• powershell -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net localgroup
• cmd.exe /c nltest
• certutil.exe -urlcache
• bitsadmin /transfer
• schtasks /create
• sc.exe create
• Event ID 4688
• Event ID 7045
• Sysmon Event ID 1

What your security team should do

• Prioritize patching all Ivanti EPM servers to 2022 SU6, the 2024 September update, or later because the flaw enables unauthenticated remote code execution and has elevated EPSS likelihood.
• Immediately remove direct internet exposure of the EPM agent portal where feasible; place access behind VPN, reverse proxy controls, or strict source-IP allowlists.
• Hunt for suspicious web-service child processes, encoded PowerShell, credential dumping activity, new scheduled tasks, new services, and unexpected files created under web-accessible directories.
• Review EPM server privileges, service accounts, stored credentials, and integrations because compromise of a management server can provide broad endpoint reach.
• If suspicious activity is found, isolate the EPM server, preserve forensic evidence, rotate credentials used by EPM, and assess managed endpoints for follow-on payload deployment.
• Add monitoring for abnormal outbound connections from the EPM server, especially to newly observed external IPs or command-and-control-like infrastructure.