CVE-2025-62390 Overview
CVE-2025-62390 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. The flaw allows a remote, authenticated attacker to read arbitrary data from the underlying database by injecting crafted input into a vulnerable query. Ivanti disclosed the issue in its October 2025 security advisory and tracks it under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
The weakness carries a confidentiality impact but does not affect integrity or availability. Exploitation requires valid credentials, which limits opportunistic attacks but keeps risk elevated in environments where credential reuse or low-privilege accounts are common.
Critical Impact
An authenticated attacker with network access to Ivanti Endpoint Manager can extract sensitive data — including managed device inventory, configuration, and potentially credentials stored in the EPM database.
Affected Products
- Ivanti Endpoint Manager 2024 (base release)
- Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
- All Ivanti Endpoint Manager versions prior to 2024 SU5
Discovery Timeline
- 2025-10-13 - CVE-2025-62390 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62390
Vulnerability Analysis
The vulnerability is a classic SQL injection issue in an authenticated code path of Ivanti Endpoint Manager. User-supplied input reaches a database query without proper parameterization or escaping. An attacker who can authenticate to the EPM console or an associated web service can manipulate the query to return data outside the intended result set.
Because the CVSS vector describes only confidentiality impact, the exploitation path centers on data exfiltration through techniques such as UNION-based extraction, boolean-based blind inference, or time-based blind inference. Write operations to the database are not indicated by the vendor advisory.
Endpoint Manager stores inventory data, device configuration, deployment tasks, and administrative metadata. Disclosure of these tables can expose IT asset details and, depending on schema contents, service credentials useful for lateral movement.
Root Cause
The root cause is improper neutralization of special SQL characters in a query built with untrusted input [CWE-89]. Instead of using parameterized queries or a prepared statement API, the affected code path concatenates or interpolates attacker-controlled values directly into the SQL statement executed against the EPM database.
Attack Vector
Exploitation requires network reachability to the Ivanti EPM management interface and a valid low-privilege account. The attacker submits crafted parameters to the vulnerable endpoint, and the backend executes the modified SQL query. No user interaction is required, and attack complexity is low. See the Ivanti Security Advisory - October 2025 for vendor-specific details.
No public proof-of-concept exploit code is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-62390
Indicators of Compromise
- Web server or application logs from the Ivanti EPM host containing SQL metacharacters (', --, UNION, SELECT, SLEEP(, WAITFOR DELAY) in request parameters.
- Anomalous authenticated sessions issuing a high volume of requests with slight parameter mutations, consistent with automated SQLi tooling such as sqlmap.
- Unexpected long-running queries or elevated database CPU tied to the EPM service account.
Detection Strategies
- Inspect Ivanti EPM IIS and application logs for encoded SQL payloads in query strings, POST bodies, and header values submitted by authenticated users.
- Enable and review SQL Server extended events or audit logs on the EPM database for queries that reference sys. catalog views, information_schema, or bulk UNION SELECT operations from the EPM application account.
- Correlate authentication events with subsequent bursts of parameterized web requests to identify credential-driven abuse.
Monitoring Recommendations
- Forward EPM web, application, and SQL audit logs to a centralized analytics platform and alert on SQLi signature matches from authenticated sessions.
- Baseline normal EPM query patterns and database volume so injection-driven data extraction stands out as an outlier.
- Monitor service accounts used by EPM for anomalous query behavior or connections from unexpected hosts.
How to Mitigate CVE-2025-62390
Immediate Actions Required
- Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as specified in the Ivanti Security Advisory - October 2025.
- Restrict network access to the EPM management interface to trusted administrative subnets and jump hosts.
- Rotate credentials for any low-privilege EPM accounts, and review console user access to remove unused or over-provisioned accounts.
Patch Information
Ivanti addressed CVE-2025-62390 in Ivanti Endpoint Manager 2024 SU5. Administrators running 2024, 2024 SU1, SU2, SU3, or SU3 Security Release 1 must apply the SU5 update. The vendor advisory is the authoritative source for download links and prerequisites.
Workarounds
- If patching cannot occur immediately, place the EPM console behind a VPN or reverse proxy that enforces multi-factor authentication and limits inbound source addresses.
- Enforce least privilege on EPM user roles so that a compromised account has minimal database access surface.
- Deploy a web application firewall in front of the EPM interface with rules that block common SQL injection signatures on authenticated endpoints.
# Example: restrict inbound access to Ivanti EPM console using Windows Firewall
# Replace the RemoteAddress values with your administrative CIDR ranges
New-NetFirewallRule -DisplayName "Ivanti EPM Console - Admin Only" `
-Direction Inbound `
-Protocol TCP `
-LocalPort 443 `
-RemoteAddress 10.10.20.0/24,10.10.30.0/24 `
-Action Allow
New-NetFirewallRule -DisplayName "Ivanti EPM Console - Block Other" `
-Direction Inbound `
-Protocol TCP `
-LocalPort 443 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
