CVE-2025-62389: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62389 Overview

CVE-2025-62389 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU5. A remote authenticated attacker can inject malicious SQL statements to read arbitrary data from the backend database. The flaw is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Ivanti published the fix as part of the Ivanti Security Advisory October 2025. Exploitation requires valid authentication to the EPM console, which limits opportunistic abuse but exposes environments where credentials are shared, weak, or obtainable through phishing.

Critical Impact
An authenticated attacker can extract sensitive information stored in the EPM database, including asset inventories, credentials, and managed device metadata.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
All Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62389 published to the National Vulnerability Database (NVD)
2025-10-13 - Ivanti releases security advisory and fixed version 2024 SU5
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-62389

Vulnerability Analysis

The vulnerability arises from improper neutralization of user-supplied input in a SQL query path exposed to authenticated EPM users. When the application constructs database queries by concatenating attacker-controlled parameters, injected SQL syntax is executed by the backend database engine.

Successful exploitation compromises the confidentiality of the EPM database. Because EPM stores managed endpoint inventories, software distribution metadata, and administrative configuration, the extracted data can accelerate follow-on attacks such as targeted credential theft, lateral movement, and endpoint tampering.

The attack vector is network-based and requires no user interaction. The privileges required are limited to any authenticated EPM account, so any low-privileged operator or service account with console access is a viable attack path.

Root Cause

The root cause is missing or insufficient input sanitization on parameters passed into SQL statements within an EPM component. The application fails to enforce parameterized queries or safe query composition, allowing attacker-controlled input to break out of the intended query context and execute additional SQL clauses such as UNION SELECT reads against arbitrary tables.

Attack Vector

An attacker who holds valid credentials for the Ivanti Endpoint Manager console sends crafted HTTP requests containing SQL metacharacters within a vulnerable parameter. The backend appends the input to a SQL statement and executes it, returning data controlled by the attacker's payload. No verified public proof-of-concept is available at this time. Refer to the Ivanti Security Advisory October 2025 for vendor-supplied technical detail.

Detection Methods for CVE-2025-62389

Indicators of Compromise

Unusual HTTP requests to EPM console endpoints containing SQL syntax such as UNION, SELECT, --, ;, CONVERT(, or encoded variants
Authenticated EPM sessions issuing high-volume or repetitive parameter fuzzing against a single endpoint
Database audit logs showing queries returning columns unrelated to the requesting UI feature
Outbound data transfers from EPM servers to non-corporate destinations shortly after authenticated console activity

Detection Strategies

Enable and centralize IIS or reverse-proxy access logs for the EPM console and inspect request bodies and query strings for SQL injection patterns
Enable SQL Server audit or Extended Events on the EPM database to log statements that reference system tables (sys.tables, INFORMATION_SCHEMA) from application accounts
Correlate EPM authentication events with subsequent anomalous query volume from the same session identifier

Monitoring Recommendations

Monitor authenticated user activity for behavior outside typical role scope, such as low-privileged operators accessing bulk data views
Alert on error responses from the EPM application that leak SQL exceptions or database schema strings
Track EPM service account query patterns against a baseline and flag deviations in row counts, joined tables, or query duration

How to Mitigate CVE-2025-62389

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as published in the October 2025 advisory
Rotate credentials for all EPM console accounts and service accounts that may have been exposed prior to patching
Review EPM audit and database logs for evidence of injection attempts or anomalous read activity dating back to the earliest affected build in the environment

Patch Information

Ivanti addressed CVE-2025-62389 in Ivanti Endpoint Manager 2024 SU5. Administrators should download the update from the Ivanti customer portal and follow the upgrade procedure documented in the Ivanti Security Advisory October 2025. Validate the installed build after upgrade and confirm all EPM roles (core server, console, and connected agents) are on a supported version.

Workarounds

Restrict network access to the EPM console to trusted administrative subnets or via VPN until the patch is deployed
Enforce multi-factor authentication and strong password policy on all EPM accounts to reduce the population of attackers who can meet the authentication precondition
Apply least-privilege review of EPM user roles, removing console access from accounts that do not require it
Place a web application firewall in front of the EPM console with SQL injection signature enforcement on request parameters

bash

# Example WAF rule concept for EPM console requests (adapt to your platform)
# Block requests where query parameters contain common SQLi tokens
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|;\s*--|\bxp_cmdshell\b|information_schema)" \
    "id:1006201,phase:2,deny,status:403,msg:'Potential SQLi against Ivanti EPM console'"