CVE-2025-7037: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2025-7037 Overview

CVE-2025-7037 is a SQL injection vulnerability [CWE-89] in Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU3 and 2022 SU8 Security Update 1. The flaw allows a remote authenticated attacker holding administrative privileges to inject SQL statements and read arbitrary data from the backing database. Ivanti published the issue in its July 2025 security advisory and released fixed builds the same month.

Critical Impact
A remote authenticated administrator can execute crafted SQL statements against the Ivanti EPM database, exposing sensitive managed-endpoint inventory, credentials, and configuration data.

Affected Products

Ivanti Endpoint Manager 2024 (base release, SU1, SU2)
Ivanti Endpoint Manager 2022 through SU8 (prior to Security Update 1)
All earlier unpatched Ivanti Endpoint Manager builds

Discovery Timeline

2025-07-08 - CVE-2025-7037 published to NVD
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-7037

Vulnerability Analysis

The vulnerability is a server-side SQL injection in Ivanti Endpoint Manager. Authenticated administrator input reaches a database query without proper parameterization or sanitization. An attacker who already holds admin credentials can append or alter SQL clauses to retrieve data outside the intended query scope.

While administrator privileges raise the bar for exploitation, EPM environments often span large fleets and store sensitive operational data. Successful injection allows enumeration of database tables, extraction of inventory records, and exposure of integration secrets stored in EPM. The network attack vector means an attacker can reach the vulnerable endpoint over the management interface without local access.

Root Cause

The defect maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command. A backend handler in the EPM web tier concatenates user-controllable parameters into SQL statements rather than binding them as parameters. Input validation does not strip or escape SQL metacharacters before query execution.

Attack Vector

Exploitation requires valid administrative credentials and network reachability to the EPM management console. The attacker submits crafted parameters to a vulnerable EPM endpoint. The backend issues the manipulated query and returns or reflects database content the attacker should not be able to read. No user interaction is required.

See the Ivanti Security Advisory July 2025 for vendor confirmation. No public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2025-7037

Indicators of Compromise

HTTP requests to EPM management endpoints containing SQL metacharacters such as single quotes, UNION SELECT, --, ;, or encoded variants in administrator-only parameters.
Database engine errors or unusually large response payloads from EPM web components following administrator activity.
Administrator sessions originating from unexpected source IP ranges or executing query-like parameter values.

Detection Strategies

Inspect EPM IIS and application logs for parameter values containing SQL syntax tokens or hex/URL-encoded SQL keywords.
Correlate EPM administrator authentication events with sustained, parameterized requests to console endpoints to surface credential abuse.
Enable SQL Server auditing on the EPM database to flag queries that deviate from the application's normal statement templates.

Monitoring Recommendations

Forward EPM web, application, and database audit logs to a central analytics platform and alert on SQL error signatures or anomalous result-set sizes.
Track administrator account usage for off-hours activity, new endpoints accessed, and elevated query volume against EPM.
Monitor outbound connections from the EPM server host for data egress patterns indicative of database extraction.

How to Mitigate CVE-2025-7037

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to 2024 SU3 or 2022 SU8 Security Update 1 as published in the July 2025 advisory.
Rotate credentials for all EPM administrator accounts and any service accounts the EPM database uses.
Restrict network access to the EPM management console to trusted administrative networks only.
Review EPM audit logs for unexpected administrator logins or query activity since the affected versions were deployed.

Patch Information

Ivanti released fixed versions in the Security Advisory July 2025 for Ivanti EPM 2024 SU2 and EPM 2022 SU8. Apply EPM 2024 SU3 or EPM 2022 SU8 Security Update 1 to remediate CVE-2025-7037. There are no supported configuration-only fixes; patching is required.

Workarounds

Enforce strict role separation and reduce the number of accounts granted EPM administrator privileges until patching is complete.
Require multi-factor authentication for all EPM administrative logins to limit exposure if credentials are stolen.
Place the EPM console behind a reverse proxy or web application firewall configured to inspect and block SQL injection patterns on administrator endpoints.

bash

# Configuration example: restrict EPM console access at the host firewall (Windows)
New-NetFirewallRule -DisplayName "Restrict EPM Console" -Direction Inbound `
  -Protocol TCP -LocalPort 443 -Action Allow `
  -RemoteAddress 10.10.20.0/24

New-NetFirewallRule -DisplayName "Block EPM Console Default" -Direction Inbound `
  -Protocol TCP -LocalPort 443 -Action Block