CVE-2025-62387: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62387 Overview

CVE-2025-62387 is a SQL injection vulnerability [CWE-89] in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. A remote authenticated attacker can exploit improperly sanitized SQL query parameters to read arbitrary data from the underlying database. The flaw affects confidentiality but does not impact integrity or availability. Ivanti addressed the issue in its October 2025 security release.

Critical Impact
Authenticated attackers can extract sensitive data from the Ivanti Endpoint Manager database, including managed device inventories, credentials, and configuration data stored by the EPM console.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3
Ivanti Endpoint Manager 2024 SU3 Security Release 1

Discovery Timeline

2025-10-13 - CVE-2025-62387 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62387

Vulnerability Analysis

The vulnerability resides in a database query path within Ivanti Endpoint Manager that concatenates user-supplied input into SQL statements without proper parameterization. An authenticated user with valid session credentials can inject SQL syntax into a vulnerable request parameter. The injected clauses execute against the EPM backend database with the privileges of the application service account.

Ivanti Endpoint Manager typically holds inventory data, software distribution metadata, patch status, and credentials used to manage endpoints. Successful exploitation allows an attacker to read this data across tenants and administrative scopes. The exposed information can support follow-on attacks against managed endpoints, including lateral movement and credential reuse.

EPSS scoring places this vulnerability in the upper portion of predicted exploitation likelihood, reflecting Ivanti's history of post-disclosure exploitation activity against Endpoint Manager products.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected code path fails to use parameterized queries or bind variables when handling attacker-controlled input, allowing SQL metacharacters to alter query structure.

Attack Vector

Exploitation requires network access to the Ivanti Endpoint Manager console and valid low-privilege authenticated credentials. No user interaction is required. The attacker submits a crafted request containing SQL syntax to a vulnerable endpoint, then reads returned data or infers database contents through boolean or time-based inference techniques.

No public proof-of-concept exploit code has been published. Technical details of the vulnerable endpoint have not been disclosed by Ivanti. Refer to the Ivanti Security Advisory - October 2025 for vendor guidance.

Detection Methods for CVE-2025-62387

Indicators of Compromise

Unusual SQL syntax patterns in Ivanti EPM web request logs, including UNION SELECT, WAITFOR DELAY, single-quote escaping, or SQL comment sequences (--, /*)
Authenticated EPM sessions issuing high volumes of parameterized requests against a small set of endpoints
Unexpected outbound database queries or extended query durations logged by the EPM SQL Server backend
Access to EPM tables containing credentials or inventory data from unexpected application service contexts

Detection Strategies

Enable and review IIS request logging on the Ivanti EPM console for anomalous query strings and POST bodies containing SQL metacharacters
Correlate EPM authentication events with subsequent request patterns to identify low-privilege accounts performing reconnaissance behavior
Deploy SQL Server auditing on the EPM database to record queries executed by the application service account and flag statements that reference sensitive tables outside normal application workflows

Monitoring Recommendations

Ingest Ivanti EPM console logs, IIS access logs, and SQL Server audit logs into a centralized SIEM for cross-source correlation
Alert on authenticated EPM sessions that generate SQL error responses or unusually long response times consistent with time-based blind SQL injection
Monitor for anomalous account behavior such as first-time access from new IP ranges combined with elevated query volume against the EPM console

How to Mitigate CVE-2025-62387

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as documented in the October 2025 Ivanti security advisory
Inventory all EPM administrative and low-privilege accounts and rotate credentials for any account that could not be verified as uncompromised
Restrict network access to the EPM console to trusted administrative networks and VPN segments
Review EPM database contents for credentials or sensitive data that may have been exposed and rotate affected secrets

Patch Information

Ivanti released the fix in Ivanti Endpoint Manager 2024 SU5. Full patch details and download links are available in the Ivanti Security Advisory - October 2025.

Workarounds

No vendor-supplied workaround has been published; upgrading to 2024 SU5 is the recommended remediation
Reduce exposure by enforcing least privilege on EPM console accounts and removing dormant or unnecessary user accounts
Place the EPM console behind a web application firewall configured with SQL injection detection rulesets as an interim compensating control
Restrict inbound connectivity to the EPM management interface using host-based firewalls or network segmentation until patching is complete

bash

# Example: restrict EPM console access to a management subnet on Windows Server
New-NetFirewallRule -DisplayName "Ivanti EPM Console - Admin Subnet Only" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 10.10.50.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Ivanti EPM Console - Block Other" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -Action Block