CVE-2025-62392: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62392 Overview

CVE-2025-62392 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) affecting versions before 2024 SU5. A remote authenticated attacker can inject crafted SQL statements to read arbitrary data from the backend database. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Ivanti disclosed the issue in its October 2025 security advisory. Because EPM manages large populations of enterprise endpoints, its database holds device inventory, credentials references, and configuration data valuable to attackers conducting reconnaissance or privilege escalation.

Critical Impact
An authenticated attacker on the network can read arbitrary records from the EPM database, exposing endpoint inventory, management data, and other sensitive content stored by the platform.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
All Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62392 published to the National Vulnerability Database
2025-10-13 - Ivanti publishes the Security Advisory Ivanti Endpoint Manager (EPM) October 2025
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-62392

Vulnerability Analysis

The vulnerability is a server-side SQL injection in Ivanti Endpoint Manager. User-controlled input reaches a SQL query without proper parameterization or sanitization, allowing an authenticated attacker to alter query logic. The attacker uses this capability to retrieve data outside of what the application intends to expose.

Exploitation requires valid credentials, which lowers risk compared to unauthenticated flaws. However, EPM commonly supports many low-privilege operator accounts, and compromised or weak credentials remain a realistic access path. The impact is bounded to confidentiality, matching the CVSS scope of read-only database access.

Root Cause

The root cause is improper neutralization of special characters in a SQL statement [CWE-89]. The affected EPM component concatenates attacker-influenced input into a query rather than binding it as a parameter. Ivanti has not published affected endpoint, parameter, or query details in its advisory.

Attack Vector

The attacker authenticates to the EPM management interface over the network. They then submit crafted input to a vulnerable request that constructs a SQL statement server-side. The payload uses standard SQL injection techniques such as UNION SELECT, boolean-based inference, or time-based blind extraction to pull arbitrary rows from any table the EPM database account can read.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Ivanti has not released sanitized exploitation code. Refer to the Ivanti Security Advisory October 2025 for official technical context.

Detection Methods for CVE-2025-62392

Indicators of Compromise

Unusual SQL syntax tokens (UNION, SELECT, --, /*, 0x, WAITFOR DELAY) appearing in HTTP parameters sent to EPM web endpoints.
Spikes in response size or response time for authenticated EPM requests, indicating UNION-based or time-based blind extraction.
EPM database queries originating from the application service account that reference sys., information_schema, or other metadata tables inconsistent with normal operations.
Authenticated EPM sessions issuing high volumes of repetitive requests against a single parameter.

Detection Strategies

Enable verbose request logging on the EPM web server and alert on query strings or form fields containing SQL metacharacters.
Correlate EPM application logs with SQL Server audit logs to attribute suspicious queries back to specific authenticated users.
Deploy a Web Application Firewall (WAF) in front of EPM with SQL injection rule sets and monitor blocked events.
Baseline typical database query patterns from the EPM service account and alert on deviation.

Monitoring Recommendations

Monitor authentication logs for brute force or credential stuffing against EPM operator accounts.
Track lateral movement from the EPM server, which indicates escalation beyond data read.
Review scheduled jobs and new admin accounts in EPM for signs of post-exploitation persistence.

How to Mitigate CVE-2025-62392

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as specified in the Ivanti advisory.
Rotate credentials for all EPM operator accounts and the EPM database service account.
Restrict network access to the EPM management console to administrative subnets and jump hosts.
Audit EPM user accounts and remove unused or over-privileged accounts.

Patch Information

Ivanti addresses CVE-2025-62392 in Ivanti Endpoint Manager 2024 SU5. Apply the update using the standard EPM patch process documented in the Ivanti Security Advisory October 2025. Validate successful patch application and restart affected services as directed by the vendor.

Workarounds

No official workaround is published by Ivanti; patching to 2024 SU5 is the required remediation path.
As a compensating control, limit EPM console exposure to a management VLAN and require VPN or ZTNA to reach it.
Enforce multi-factor authentication on all EPM administrative accounts to raise the bar for the required authenticated access.
Apply least privilege to the EPM database account so that successful injection has reduced data scope.

bash

# Example: restrict EPM console access with host-based firewall rules (Windows)
New-NetFirewallRule -DisplayName "Allow EPM Console - Admin Subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 10.10.50.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block EPM Console - All Other" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -Action Block