Ivanti Endpoint Manager Improper Signature Verification Vulnerability Allowing Remote Code Execution

A vulnerability in Ivanti Endpoint Manager (EPM) has been identified, specifically in versions prior to the January 2025 Security Update for both EPM 2024 and EPM 2022 SU6. This vulnerability arises from improper signature verification, which allows a remote, unauthenticated attacker to execute code. However, exploitation requires local user interaction.

Impact

Exploitation of this vulnerability leads to unauthorized remote code execution on the affected system.

Remediation

Users can apply the Security Hot Patch available for their version of Ivanti Endpoint Manager. For EPM 2024, the patch can be downloaded from the Ivanti License System (ILS) and applied to the core server and remote consoles. For EPM 2022 SU6, the same process applies. After applying the patch, the Core Server should be rebooted.