Ivanti Endpoint Manager Out-of-Bounds Write Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Ivanti Endpoint Manager (EPM) versions prior to the January 2025 security update for both the 2024 and 2022 SU6 releases. The vulnerability arises from an out-of-bounds write, allowing remote unauthenticated attackers to disrupt service.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, disrupting normal service operations.

Remediation

Users can apply the security hot patch available for their EPM version. For EPM 2024, the hot patch can be downloaded from the Ivanti License System (ILS) and applied to the core server and remote consoles. For EPM 2022 SU6, the same process applies. After applying the patch, the core server should be rebooted.