CVE-2024-32840: Ivanti Endpoint Manager RCE Vulnerability

CVE-2024-32840 Overview

CVE-2024-32840 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote authenticated attacker with administrative privileges to achieve remote code execution. The flaw affects EPM 2022 releases prior to SU6 and the EPM 2024 release before the September 2024 update. Ivanti disclosed the issue in its September 2024 security advisory and categorized it under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability requires authentication with admin privileges but no user interaction, and it impacts the confidentiality, integrity, and availability of the affected system.

Critical Impact
An authenticated administrator can inject malicious SQL statements against the EPM backend database and leverage the injection to execute arbitrary code on the server hosting Ivanti Endpoint Manager.

Affected Products

Ivanti Endpoint Manager 2022 (base release through SU5)
Ivanti Endpoint Manager 2024 (before the September 2024 update)
Ivanti Endpoint Manager deployments managing enterprise Windows, macOS, and Linux endpoints

Discovery Timeline

2024-09-12 - CVE-2024-32840 published to NVD alongside Ivanti's September 2024 EPM security advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32840

Vulnerability Analysis

The vulnerability is a SQL injection flaw in an unspecified component of Ivanti Endpoint Manager. Attacker-controlled input reaches a SQL query without proper sanitization or parameterization. Because EPM stores management data and executes administrative tasks through database-driven workflows, injection into these queries can be chained into command execution on the underlying host.

Attackers with admin credentials can query, modify, or exfiltrate data across the EPM database. They can also pivot from database access to operating-system command execution using database features such as stored procedures or extended procedures that invoke shell commands. This turns a data-tier flaw into a full server compromise.

The EPSS score of 25.389% places CVE-2024-32840 in the 97th percentile for exploit likelihood, indicating elevated risk relative to the broader CVE population despite the admin authentication requirement.

Root Cause

The root cause is improper neutralization of special elements in SQL statements, classified as CWE-89. User-controllable parameters are concatenated into SQL queries rather than bound as parameters. Ivanti has not disclosed the specific endpoint or query responsible for the injection.

Attack Vector

Exploitation requires network access to the Ivanti EPM management interface and valid administrator credentials. An attacker who has stolen or otherwise obtained admin credentials, or an insider with legitimate admin access, submits crafted input to a vulnerable EPM function. The injected SQL executes with the privileges of the EPM database account, which typically has broad access to the management database and, through database extension features, to the host operating system.

Because EPM is an endpoint management platform, code execution on the EPM server can be used to push malicious tasks or software distributions to all managed endpoints, amplifying the blast radius.

No public proof-of-concept exploit or CISA KEV listing is currently associated with CVE-2024-32840. See the Ivanti Security Advisory September 2024 for vendor-provided technical details.

Detection Methods for CVE-2024-32840

Indicators of Compromise

Unexpected SQL error messages, query timeouts, or malformed statements in EPM database and application logs
New or modified stored procedures, jobs, or logins in the EPM SQL database that were not created by administrators
xp_cmdshell or equivalent OS-command invocations originating from the EPM database service account
Unusual child processes spawned by the SQL Server process (sqlservr.exe) such as cmd.exe, powershell.exe, or rundll32.exe

Detection Strategies

Enable and review EPM administrative audit logs for anomalous parameter values, oversized inputs, or SQL syntax characters in admin-facing requests
Monitor endpoint telemetry on the EPM server for process lineage where the SQL Server service spawns interactive shells or scripting engines
Correlate EPM admin authentication events with subsequent database schema or configuration changes to identify potential misuse

Monitoring Recommendations

Alert on any successful admin logins to EPM from unusual source addresses or outside change-management windows
Track outbound network connections from the EPM server to non-standard destinations, which may indicate post-exploitation command-and-control
Baseline EPM database service account behavior and flag deviations, especially execution of OS-level commands or file-system writes outside standard directories

How to Mitigate CVE-2024-32840

Immediate Actions Required

Upgrade Ivanti EPM 2022 to SU6 or later, and Ivanti EPM 2024 to the September 2024 update or later
Rotate credentials for all EPM administrator accounts and the EPM database service account after patching
Restrict network access to the EPM management console to trusted administrative networks only
Enforce multi-factor authentication for all EPM administrator accounts to reduce risk of credential misuse

Patch Information

Ivanti released fixes in the September 2024 EPM security update. Administrators should apply Ivanti EPM 2022 SU6 or the EPM 2024 September update as documented in the Ivanti Security Advisory September 2024. No official workaround replaces patching.

Workarounds

Limit EPM administrator access using role-based access control and remove unused or dormant admin accounts
Segment the EPM server and its database onto a management VLAN with strict ingress and egress firewall rules
Disable database features such as xp_cmdshell on the EPM SQL instance unless explicitly required by supported EPM functionality
Increase logging verbosity on the EPM application and database tiers to support detection until patching is complete