Ivanti Workspace Control Hardcoded Key Vulnerability Allowing Decryption of SQL Credentials

A vulnerability exists in Ivanti Workspace Control versions prior to 10.19.10.0, where a hardcoded key allows local authenticated attackers to decrypt stored SQL credentials. This vulnerability could lead to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability could result in the decryption of SQL credentials, potentially allowing unauthorized access to databases and their contents.

Remediation

Users can upgrade to Ivanti Workspace Control 2025.2 (10.19.x.x), which addresses these security issues. Instructions for migrating to the new IWC architecture are available in the Ivanti Workspace Control 2025.2 Migration Guide. Customers who prefer not to upgrade can migrate to Ivanti User Workspace Manager.