Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Ivanti Endpoint Manager allows attackers to take control with admin access

CVE-2024-50326 · published 1 year ago
Summary

Ivanti Endpoint Manager, a tool used to manage company computers, has a security weakness that lets hackers with admin access to the system gain complete control over it. This is a serious issue because it allows an attacker to do anything they want with the system. To protect your system, update to the latest version with the November security patch.

What to do
  • Update ivanti endpoint_manager to version 2022 or later.
Affected software
VendorProductAffected versions
ivanti endpoint_manager < 2022
2022
2024
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
Original advisory text
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote cod...
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
26% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published12 Nov 2024
Updated30 Sep 2026
First seen7 Mar 2026
Sources
CVE-2024-50326 · NVD
Track software like this
Free during beta