CVE-2024-29824

HIGH8.8

CISA KEV

Published 2024-05-31 · Updated 2026-06-17 · Source support@hackerone.com

Summary

CVE-2024-29824 is a high-severity (CVSS 8.8) vulnerability in Ivanti Endpoint Manager (EPM). CISA added it to the Known Exploited Vulnerabilities catalog on October 2, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 23, 2024. CISA does not currently list it as used in ransomware campaigns. Ivanti has 38 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.

All 38 known-exploited Ivanti vulnerabilities →

Description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-89CWE-89

CISA Known-Exploited Vulnerability

Product: Ivanti — Endpoint Manager (EPM)

Name: Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

Date added: 2024-10-02 · Due: 2024-10-23

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Ivanti vulnerabilities

Most recently added to CISA KEV

CVE-2026-118527
Connect Secure — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
added 2026-10-30
CVE-2026-111357
Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
added 2026-10-30
CVE-2026-104935
Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
added 2026-10-13
CVE-2026-10520
Sentry — Ivanti Sentry OS Command Injection Vulnerability
added 2026-06-11
CVE-2026-6973
Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
added 2026-05-07
CVE-2026-1340
Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
added 2026-04-08

View all →

Related CVEs

Same severity, most recent

CVE-2026-75590
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
2026-11-07 · score 7.2
CVE-2026-19128
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
2026-11-07 · score 7.5
CVE-2026-19121
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
2026-11-07 · score 8.3
CVE-2026-17411
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
2026-11-07 · score 7.6
CVE-2026-17407
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
2026-11-07 · score 8.5