CVE-2025-22461 Overview
CVE-2025-22461 is a SQL injection vulnerability [CWE-89] in Ivanti Endpoint Manager (EPM) that allows a remote authenticated attacker with administrative privileges to achieve code execution. The flaw affects EPM versions prior to 2024 SU1 and prior to 2022 SU7. Ivanti disclosed the issue in its April 2025 security advisory and released fixes in the same cycle.
The vulnerability carries a CVSS 3.1 score of 7.2 and impacts confidentiality, integrity, and availability. Because exploitation requires existing administrator credentials, the issue primarily represents a post-authentication escalation path into operating system command execution on the EPM server.
Critical Impact
Authenticated administrators can pivot from EPM management access to arbitrary code execution on the underlying server, exposing managed endpoints across the enterprise.
Affected Products
- Ivanti Endpoint Manager 2022 (base release through SU6)
- Ivanti Endpoint Manager 2024 (base release prior to SU1)
- All EPM deployments managing distributed Windows endpoints via these versions
Discovery Timeline
- 2025-04-08 - CVE-2025-22461 published to NVD alongside Ivanti's April 2025 EPM security advisory
- 2025-05-16 - Last updated in NVD database
Technical Details for CVE-2025-22461
Vulnerability Analysis
The flaw is a classic SQL injection in Ivanti Endpoint Manager's administrative interface. An authenticated user with administrator privileges can submit crafted input that is concatenated into a backend SQL query without proper parameterization or sanitization. Because the EPM database service runs with elevated privileges, the injection chain can be leveraged to invoke procedures that execute operating system commands.
The Common Weakness Enumeration classification is [CWE-89], Improper Neutralization of Special Elements used in an SQL Command. The attack proceeds over the network and does not require user interaction, but the high privilege requirement limits the initial attacker population to compromised admin accounts or insiders.
EPM is widely deployed to manage Windows endpoints, software distribution, patching, and inventory. Code execution on the EPM server therefore provides a direct path to influencing every managed device, making this vulnerability attractive for lateral movement and supply-chain style attacks within an enterprise.
Root Cause
The root cause is unsafe construction of SQL statements from administrator-controlled input. Affected code paths fail to use parameterized queries or strict input validation before passing values to the database engine. Database execution context then permits transition from query injection to operating system command execution through built-in extended stored procedures or feature abuse.
Attack Vector
An attacker who has obtained EPM administrator credentials authenticates to the management console or its API endpoints. They submit malicious SQL payloads through parameters processed by the vulnerable function. The injected SQL executes in the database tier and is chained into command execution on the host. No phishing, social engineering, or victim interaction is required once admin access exists.
The vulnerability is described in prose only because no public proof-of-concept code or verified exploit is currently available. See the Ivanti Security Advisory April 2025 for vendor technical details.
Detection Methods for CVE-2025-22461
Indicators of Compromise
- Unexpected child processes spawned by the EPM database service or w3wp.exe hosting the EPM web application
- SQL query strings containing concatenation patterns, stacked queries, or xp_cmdshell invocations in database audit logs
- New or modified files in EPM installation directories outside of patch windows
- Outbound network connections from the EPM server to unfamiliar hosts following administrator console activity
Detection Strategies
- Enable SQL Server audit logging on the EPM database and alert on use of xp_cmdshell, sp_OACreate, or other command-execution surfaces
- Hunt for anomalous administrator sessions in EPM web logs, particularly long URL parameters, encoded quotes, and SQL keywords
- Correlate EPM admin authentication events with subsequent process creation on the EPM host using endpoint telemetry
Monitoring Recommendations
- Forward EPM application logs, IIS logs, and SQL audit logs to a centralized analytics platform such as Singularity Data Lake for retention and cross-source correlation
- Use behavioral endpoint protection such as Singularity Endpoint to identify process-spawning anomalies on the EPM server
- Review and reduce the number of EPM administrator accounts and enforce multi-factor authentication on all of them
How to Mitigate CVE-2025-22461
Immediate Actions Required
- Upgrade Ivanti Endpoint Manager 2024 to SU1 or later
- Upgrade Ivanti Endpoint Manager 2022 to SU7 or later
- Rotate credentials and review session activity for all EPM administrator accounts
- Audit recent administrator actions in EPM for unexpected configuration changes or script executions
Patch Information
Ivanti released remediated builds in the April 2025 EPM security advisory. The fixed versions are EPM 2024 SU1 and EPM 2022 SU7. Customers should obtain installers from the Ivanti download portal and follow vendor upgrade procedures. Reference the Ivanti Security Advisory April 2025 for complete patch guidance.
Workarounds
- Restrict EPM administrative console access to a small set of jump hosts using firewall rules or network segmentation
- Enforce multi-factor authentication on every EPM admin account to reduce credential-theft risk
- Disable xp_cmdshell and other command-execution surfaces on the EPM database where operationally feasible
- Apply least-privilege principles to the SQL Server service account used by EPM
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
