A critical SQL injection vulnerability in the Ivanti Endpoint Manager web console allows authenticated attackers to gain remote code execution, posing a significant risk to enterprise environments.

The application fails to properly neutralize special elements used in SQL commands (CWE-89), leading to SQL injection. The vulnerability requires the attacker to be authenticated (PR:L), but once exploited, it allows for remote code execution on the server.

The ability to execute arbitrary code via the Endpoint Manager console provides an attacker with complete control over the management platform. With a CVSS score of 8.8, this vulnerability could be used to deploy malware, exfiltrate sensitive endpoint data, or move laterally within the network.

Immediate Action: Upgrade Ivanti Endpoint Manager to version 2024 SU6 or later immediately.

Proactive Monitoring: Review web console logs for suspicious SQL syntax or unusual query behavior that may indicate an ongoing exploitation attempt.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rulesets configured to detect and block common SQL injection patterns targeting administrative web consoles.

Public Exploit Available: false

Ivanti Endpoint Manager is a critical infrastructure component; therefore, any vulnerability allowing remote code execution must be addressed with the highest priority. Administrators should proceed with the update to 2024 SU6 immediately to secure the environment.