CVE-2025-62391: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62391 Overview

CVE-2025-62391 is a SQL injection vulnerability [CWE-89] in Ivanti Endpoint Manager (EPM) before version 2024 SU5. A remote authenticated attacker can exploit the flaw to read arbitrary data from the backing database. The issue affects confidentiality of records managed by EPM, including device inventory, user data, and configuration details.

Ivanti published the fix in the October 2025 security advisory. The vulnerability requires valid credentials but no user interaction, and the attack is executed over the network.

Critical Impact
Authenticated attackers can extract arbitrary data from the Ivanti Endpoint Manager database, exposing sensitive asset, user, and configuration information managed by the platform.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62391 published to the National Vulnerability Database
2026-10-08 - Record last updated in NVD

Technical Details for CVE-2025-62391

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in an SQL command within Ivanti Endpoint Manager. An authenticated user can inject SQL syntax into a parameter that is concatenated into a database query without adequate sanitization or parameterization.

Successful exploitation permits arbitrary read access to database contents. Because EPM centralizes endpoint inventory, patch state, software deployment data, and administrative accounts, exposed records can accelerate downstream attacks against managed assets.

The flaw does not grant write access or impact service availability according to the published CVSS vector. However, data read through this channel often includes credentials, hostnames, software versions, and policy information that supports lateral movement.

Root Cause

The root cause is a classic failure to use parameterized queries or prepared statements in a server-side component that processes authenticated requests. User-supplied input reaches the SQL interpreter without proper validation, allowing query logic manipulation.

Attack Vector

An attacker needs network access to the EPM management interface and valid low-privileged credentials. The attacker submits crafted input to a vulnerable endpoint, injecting SQL fragments that extend the server-generated query. The database then returns data outside the scope of the original request.

No verified public exploit code is available at the time of writing. Refer to the Ivanti Security Advisory October 2025 for vendor technical details.

Detection Methods for CVE-2025-62391

Indicators of Compromise

Unexpected SQL syntax tokens such as UNION SELECT, --, ';, or WAITFOR DELAY in HTTP request parameters sent to EPM endpoints.
Anomalous database query patterns originating from the EPM application service account, including queries referencing INFORMATION_SCHEMA or system tables.
Authentication from EPM user accounts followed by atypical API or web request volumes targeting management endpoints.

Detection Strategies

Enable verbose web and database audit logging on the EPM server and correlate query errors with the originating HTTP session.
Deploy web application firewall rules that flag SQL metacharacters in parameters submitted to EPM URIs.
Hunt in SIEM telemetry for authenticated EPM sessions that generate database errors or large result sets outside baseline behavior.

Monitoring Recommendations

Monitor EPM administrative accounts for logins from unexpected sources or outside normal hours.
Alert on database connections from the EPM service that return abnormally large payloads or execute queries against unrelated schemas.
Track and review changes to EPM user privileges, especially new or elevated accounts added after the advisory date.

How to Mitigate CVE-2025-62391

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as directed by the vendor advisory.
Rotate credentials for any EPM accounts that may have been exposed, including service and administrative accounts.
Restrict network reachability to the EPM management console to trusted administrative networks only.

Patch Information

Ivanti addressed CVE-2025-62391 in Endpoint Manager 2024 SU5. Review the Ivanti Security Advisory October 2025 for the full list of fixed issues and upgrade instructions.

Workarounds

Enforce least privilege on EPM user accounts to limit the data accessible through an authenticated SQL injection session.
Place the EPM web interface behind a VPN or zero-trust access gateway and apply multi-factor authentication to all administrative logins.
Deploy database activity monitoring to detect and block queries that deviate from the EPM application's expected query set.

bash

# Example: restrict access to EPM management interface at the network layer
# Replace <trusted-admin-subnet> and <epm-server-ip> with environment values
iptables -A INPUT -p tcp -s <trusted-admin-subnet> -d <epm-server-ip> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <epm-server-ip> --dport 443 -j DROP