Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-62384: Ivanti Endpoint Manager SQL Injection Allows Data Exposure

CVE-2025-62384 · published 1 year ago

Summary

A security weakness in Ivanti Endpoint Manager before version 2024 SU5 allows an attacker to access sensitive data. This data exposure could occur when an attacker is already authenticated to the system. To protect your data, update to the latest version of Ivanti Endpoint Manager.

What to do

Update ivanti endpoint_manager to version 2024 or later.

Affected software

Vendor	Product	Affected versions
ivanti	endpoint_manager	< 2024 2024 `cpe:2.3:a:ivanti:endpoint_manager::::::::`

Original advisory text

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EP... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published13 Oct 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-62384 · NVD

Track software like this

Free during beta