CVE-2025-62386: Ivanti Endpoint Manager SQL Injection

CVE-2025-62386 Overview

CVE-2025-62386 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU5. A remote authenticated attacker can inject crafted SQL statements to read arbitrary data from the underlying database. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Ivanti disclosed the issue in its October 2025 security advisory.

Critical Impact
An authenticated attacker with network access to the EPM console can extract sensitive database records, including managed endpoint metadata, credentials, and administrative configuration data.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62386 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62386

Vulnerability Analysis

CVE-2025-62386 is a server-side SQL injection flaw in Ivanti Endpoint Manager. The affected component fails to properly neutralize user-supplied input before passing it into a SQL query context. An authenticated attacker can append or modify SQL syntax to alter the intended query. Successful exploitation returns database content that the attacker's role would not normally be authorized to access.

The vulnerability impacts confidentiality only. The advisory does not report integrity or availability effects, indicating the attacker can SELECT data but cannot reliably modify or destroy records through this path. According to the Exploit Prediction Scoring System (EPSS), the probability of exploitation in the next 30 days is low, but authenticated attackers on the internal network remain the most realistic threat model.

Root Cause

The root cause is improper input validation and the absence of parameterized queries in one or more EPM request handlers. User-controlled parameters flow directly into dynamically constructed SQL statements. Because the query is executed with the privileges of the EPM service account, all tables accessible to that account become readable to the attacker.

Attack Vector

Exploitation requires network access to the Ivanti Endpoint Manager server and valid authenticated credentials at low privilege. The attacker submits a crafted HTTP request containing SQL metacharacters, boolean, time-based, or UNION-based payloads within a vulnerable parameter. No user interaction is required. Ivanti has not published exploitation specifics, and no public proof-of-concept exists at the time of writing.

See the Ivanti Security Advisory October 2025 for vendor guidance and the list of fixed CVEs.

Detection Methods for CVE-2025-62386

Indicators of Compromise

Web server or IIS logs on the EPM host containing SQL metacharacters such as ', --, UNION SELECT, WAITFOR DELAY, or hex-encoded payloads inside request parameters.
Unexpected SQL Server sessions originating from the EPM application pool identity that execute long-running or unusual SELECT queries against sensitive tables.
Authentication events for low-privilege EPM accounts followed by high-volume outbound HTTP responses from the console.

Detection Strategies

Enable SQL Server auditing on the EPM database and alert on queries containing suspicious constructs such as UNION ALL SELECT NULL, information_schema, or sysobjects originating from the EPM service account.
Deploy a web application firewall (WAF) in front of the EPM management interface with signatures tuned to SQL injection patterns and log all blocked requests for review.
Correlate authenticated EPM console sessions with abnormal database query volume or response size using centralized log analytics.

Monitoring Recommendations

Ingest EPM application, IIS, and SQL Server logs into a centralized SIEM and retain them for at least 90 days to support retrospective hunts.
Baseline normal query patterns from the EPM service account and alert on deviations in query structure, table access, or execution time.
Monitor for privilege changes or new local accounts created on the EPM server following any suspicious authenticated session.

How to Mitigate CVE-2025-62386

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as specified in the vendor advisory.
Audit all EPM user accounts and remove or disable stale, shared, or over-privileged accounts that could be leveraged by an authenticated attacker.
Rotate credentials and API tokens stored in the EPM database if compromise is suspected during the exposure window.

Patch Information

Ivanti addressed CVE-2025-62386 in Endpoint Manager 2024 SU5. Administrators should review the Ivanti Security Advisory October 2025 for download links, prerequisites, and the full list of remediated issues in the same release.

Workarounds

Restrict network access to the EPM management interface to trusted administrative subnets and VPN endpoints only.
Enforce strong authentication and multi-factor authentication (MFA) for all EPM console users to reduce the pool of accounts an attacker can leverage.
Apply least-privilege configuration to the EPM database service account so that any successful injection returns the smallest possible data set.

bash

# Example: restrict EPM console access at the Windows Firewall to a management subnet
New-NetFirewallRule -DisplayName "Restrict EPM Console" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block EPM Console Default" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -Action Block