CVE-2025-62391
📋 TL;DR
This SQL injection vulnerability in Ivanti Endpoint Manager allows authenticated attackers to read arbitrary data from the database. Organizations using Ivanti EPM versions before 2024 SU5 are affected by this data exposure risk.
💻 Affected Systems
- Ivanti Endpoint Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive data including credentials, configuration details, and endpoint information, potentially leading to lateral movement and full system compromise.
Likely Case
Authenticated attackers reading sensitive configuration data, user information, or endpoint details from the database.
If Mitigated
Limited data exposure with proper authentication controls and database permissions restricting sensitive data access.
🎯 Exploit Status
Requires authenticated access and SQL injection knowledge
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024 SU5 or later
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025
Restart Required: No
Instructions:
1. Download Ivanti EPM 2024 SU5 or later from the Ivanti portal. 2. Follow standard Ivanti EPM upgrade procedures. 3. Verify successful installation and functionality.
🔧 Temporary Workarounds
Restrict Database Access
allImplement least privilege database permissions to limit what authenticated users can access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate EPM servers
- Enhance authentication controls and monitor for suspicious database queries
🔍 How to Verify
Check if Vulnerable:
Check Ivanti EPM version in the web interface under Help > AboutCheck Version:
Check web interface or use Ivanti EPM management consoleVerify Fix Applied:
Confirm version is 2024 SU5 or later and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns from EPM web interface
- Multiple failed SQL injection attempts in web logs
Network Indicators:
- Unusual database traffic from EPM servers
- Suspicious SQL patterns in HTTP requests
SIEM Query:
source="epm_web_logs" AND (sql OR union OR select OR from OR where) AND status=200