Ivanti Endpoint Manager Improper Signature Verification Vulnerability in Patch Management Component Allowing Remote Code Execution

A vulnerability exists in the patch management component of Ivanti Endpoint Manager, affecting versions through 2024 SU4 and prior. This vulnerability arises from improper verification of cryptographic signatures, which allows a remote, unauthenticated attacker to execute arbitrary code. Exploitation of this vulnerability requires user interaction.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Users can upgrade to Ivanti Endpoint Manager 2024 SU4 SR1, available for download through the Ivanti License System. This update applies to both core and remote consoles.