CVE-2024-29824

The SQL Injection vulnerability present in the Core server of Ivanti Endpoint Manager 2022 and earlier versions represents a significant security risk. This type of vulnerability allows an attacker to manipulate SQL queries by injecting arbitrary SQL code into input fields that are not properly sanitized. The flaw arises from the application’s failure to validate user inputs, which can lead to unauthorized access to the database. This can result in the execution of arbitrary code, potentially allowing attackers to gain control over the underlying server and access sensitive data.

Attack vectors for this vulnerability are particularly concerning due to the requirement for only local network access. An unauthenticated attacker within the same network can exploit this weakness, making it easier for malicious actors to launch attacks without needing to breach external defenses. For instance, an attacker could craft a malicious request that alters the SQL query executed by the server, enabling them to extract sensitive information, modify database contents, or even execute administrative commands. Scenarios may include using social engineering to gain access to the local network or leveraging compromised devices to facilitate the attack.

The real-world impact of this vulnerability can be severe, especially for organizations that rely on Ivanti Endpoint Manager for managing their IT infrastructure. Successful exploitation could lead to data breaches, loss of sensitive information, and disruption of services. Businesses could face significant financial repercussions, including regulatory fines, loss of customer trust, and costs associated with incident response and remediation. The potential for widespread damage is amplified in environments where sensitive data is processed, such as healthcare, finance, and government sectors.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regular security assessments, including vulnerability scanning and penetration testing, can help identify potential weaknesses in the application. Additionally, employing web application firewalls (WAFs) can provide an extra layer of defense by filtering out malicious traffic before it reaches the application. It is also essential to ensure that input validation and parameterized queries are utilized in the application’s code to prevent SQL injection attacks. Organizations should prioritize patch management to ensure that they are running the latest, most secure versions of the software, as updates often include critical security fixes.

In conclusion, the SQL Injection vulnerability in Ivanti Endpoint Manager poses a serious threat to organizations that utilize this software. The ability for an attacker to execute arbitrary code within the same network highlights the importance of robust security practices. By understanding the technical details, potential attack vectors, and real-world implications of this vulnerability, organizations can better prepare themselves to defend against such threats. Implementing effective detection and mitigation strategies will be crucial in safeguarding sensitive data and maintaining the integrity of their IT environments.

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2024-29824, reflecting a significant uptick in exploitation attempts within affected networks. This surge coincides with the recent addition of the vulnerability to the KEV catalog, which has likely increased attacker focus and facilitated the development and dissemination of multiple proof-of-concept exploits, including optimized variants and integration into widely used penetration testing frameworks. Although the EPSS score remains high and stable, the rapid increase in observed exploitation attempts underscores a growing adversary interest and operationalization of this vulnerability. For defenders, this evolving threat landscape elevates the urgency of monitoring network activity for indicators of compromise and reassessing exposure, as the potential for unauthenticated remote code execution within the same network amplifies the risk of lateral movement and broader system compromise. Consequently, the threat level associated with CVE-2024-29824 should be considered heightened, reflecting both increased attacker activity and the availability of accessible exploitation tools.

Update 2 — May 20, 2026

CSURFACE threat intelligence has identified a critical update in the risk profile of CVE-2024-29824, marked by an upward revision of its CVSS score from 8.8 to 9.6, reflecting a reassessment of the vulnerability’s exploitability and impact. This adjustment underscores a heightened potential for unauthenticated remote code execution within affected Ivanti EPM environments. Concurrently, our telemetry indicates a significant reduction in detection activity, which may suggest a temporary decline in widespread exploitation or a shift in attacker tactics toward more targeted operations. Notably, this vulnerability has now been linked to a ransomware group, introducing a new dimension of threat that elevates the risk of ransomware campaigns leveraging this exploit for initial access or lateral movement. Although the EPSS score remains high and stable, the addition of ransomware associations signals an increased likelihood of this vulnerability being weaponized in financially motivated attacks. The emergence of multiple proof-of-concept exploits and a Metasploit module further lowers the barrier for adversaries to operationalize this vulnerability. Collectively, these developments necessitate an elevated threat level classification, emphasizing the critical need for defenders to maintain vigilant network monitoring and reassess exposure, as the convergence of high exploitability, ransomware interest, and accessible exploitation tools significantly amplifies the operational risk posed by CVE-2024-29824.

Update 3 — June 10, 2026

Recent updates to CVE-2024-29824 reveal a downward revision of its CVSS score from 9.6 to 8.8, reflecting a refined understanding of the vulnerability’s exploitability and impact. This adjustment aligns with the KEV program’s recent inclusion of the vulnerability, which classifies it as a high-severity issue but not at the critical threshold initially estimated. Despite this recalibration, CSURFACE threat intelligence notes that the exploitability remains exceptionally high, as evidenced by the stable EPSS score near the maximum percentile and the availability of multiple proof-of-concept exploits, including an optimized GitHub variant and a Metasploit module. The ransomware landscape remains largely uninvolved, with no confirmed associations to known ransomware groups or campaigns, which slightly mitigates the immediate risk of financially motivated exploitation. However, the presence of unauthenticated remote code execution capabilities within the same network segment continues to pose a significant operational threat. For defenders, this nuanced shift underscores the importance of contextualizing CVSS scores alongside exploit availability and attacker interest rather than relying solely on numerical severity ratings. The overall threat level remains elevated due to the ease of exploitation and the broad exposure of affected Ivanti EPM deployments, necessitating sustained vigilance despite the modest score reduction.

Update 4 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2024-29824, with telemetry indicating a sharp increase in exploit attempts within affected network segments. This surge coincides with the recent inclusion of the vulnerability in the KEV catalog, which has elevated its EPSS score to near certainty of exploitation. The emergence of new proof-of-concept exploits, including optimized variants and integration into widely used penetration testing frameworks, further lowers the barrier for adversaries to weaponize this flaw. Although no high-confidence ransomware associations have been identified, the ease of unauthenticated remote code execution in Ivanti EPM environments amplifies the operational risk, especially in internal network contexts. For defenders, this trend signals a heightened urgency to monitor for exploitation attempts and reassess exposure, as the threat landscape is becoming more active and accessible to a broader range of attackers. Consequently, the overall threat level for CVE-2024-29824 should be considered elevated, reflecting both increased attacker interest and the practical availability of exploitation tools.