CVE-2025-62388: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62388 Overview

CVE-2025-62388 is a SQL injection vulnerability [CWE-89] in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. A remote authenticated attacker can inject crafted SQL statements to read arbitrary data from the backend database. The flaw affects confidentiality but does not impact integrity or availability according to the published CVSS metrics. Ivanti disclosed the issue in its October 2025 security advisory and shipped a fix in the 2024 SU5 release. Organizations running Ivanti EPM 2024 and earlier service updates should treat this as a priority patch, since EPM databases typically store managed-device inventory, credentials references, and operational data that aid lateral movement.

Critical Impact
Authenticated attackers can exfiltrate sensitive data from the Ivanti EPM database, including device inventory and management metadata useful for follow-on attacks.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62388 published to the National Vulnerability Database
2025-10-13 - Ivanti publishes the October 2025 Endpoint Manager security advisory
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-62388

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in a component of Ivanti Endpoint Manager that accepts attacker-controlled input and incorporates it into SQL queries without proper parameterization. Because exploitation requires valid authentication, the attack surface is limited to users already provisioned on the EPM console or to credentials obtained through phishing or reuse. Successful exploitation enables arbitrary database read operations against the EPM datastore. Ivanti's advisory marks the fix as part of the October 2025 release train, with no indication of in-the-wild exploitation at publication time.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. User-supplied input reaches a query construction path without binding parameters or applying an allow-list, letting an attacker break out of the intended query context. Ivanti has not published the specific endpoint or parameter affected.

Attack Vector

An authenticated attacker sends crafted requests over the network to the Ivanti EPM management interface. The injected payload modifies the executed SQL statement to return data from tables the attacker is not authorized to view. No user interaction is required beyond the attacker's own authenticated session. Impact is confined to data confidentiality, with no direct code execution path disclosed. See the Ivanti Security Advisory October 2025 for vendor guidance.

Detection Methods for CVE-2025-62388

Indicators of Compromise

Unexpected SQL syntax tokens (UNION, SELECT, --, ;, /*) in HTTP request parameters sent to the EPM web console
Authenticated sessions issuing a high volume of parameterized requests to inventory, reporting, or query-building endpoints
Database audit logs showing EPM service accounts reading tables outside normal application workflows
Anomalous outbound data transfers originating from the EPM server shortly after authenticated console activity

Detection Strategies

Enable SQL Server auditing on the EPM database and alert on queries that reference system catalogs or tables outside the standard EPM query set
Deploy a web application firewall in front of the EPM console with SQL injection signatures tuned for the Ivanti request schema
Correlate EPM web server access logs with database query logs to identify request-to-query patterns that deviate from baseline
Hunt for low-privileged EPM accounts issuing queries that return large result sets or long response times indicative of blind SQL injection

Monitoring Recommendations

Centralize EPM web server, Windows event, and SQL Server logs into a SIEM for cross-source correlation
Monitor authentication events for new or dormant EPM accounts suddenly becoming active
Track configuration drift on the EPM server to detect post-exploitation persistence attempts

How to Mitigate CVE-2025-62388

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as published in the October 2025 advisory
Inventory all EPM accounts and disable or rotate credentials for unused or shared logins
Restrict network access to the EPM management console to administrative subnets and jump hosts
Review database and web server logs for the past 90 days for signs of exploitation activity

Patch Information

Ivanti released a fix in Endpoint Manager 2024 SU5. Administrators should download and apply the Service Update through the Ivanti customer portal and validate the installed build after reboot. Full remediation details are available in the Ivanti Security Advisory October 2025.

Workarounds

No official workaround is documented by Ivanti; patching is the required remediation
Reduce exposure by enforcing network segmentation and limiting EPM console access to trusted administrators
Apply least-privilege principles to EPM service accounts and the underlying SQL Server login used by the application

bash

# Verify installed Ivanti EPM version on the core server (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\LANDesk\ManagementSuite\Setup" |
  Select-Object ProductVersion, ProductRelease, ServicePack

# Restrict access to the EPM web console to an administrative subnet
New-NetFirewallRule -DisplayName "Restrict EPM Console" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 10.10.50.0/24 -Action Allow