Ivanti EPM CVE-2024-29824: SQL Injection to RCE (KEV)

What to do

1. Record the EPM version and service update on every core server.
2. Upgrade any EPM 2022 core server to EPM 2024 SU5 or later; EPM 2022 is end of life.
3. Keep the core server's web services reachable only from managed endpoints and admin networks, never the internet.
4. Check whether xp_cmdshell is enabled on the EPM SQL Server instance and turn it off unless you need it.
5. If a core server ran unpatched between June and October 2024, investigate it and rotate the credentials EPM stores for managing endpoints.

How to check if you are affected or compromised

• Run SELECT name, value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell' on the EPM database server; an unexpected 1 is a red flag.
• Search SQL Server error logs and audit data for xp_cmdshell use, which Horizon3 names as the likely sign of this exploit.
• Look in EDR data for sqlservr.exe starting cmd.exe, powershell.exe or other programs.
• Review IIS logs on the core server for requests to /WSStatusEvents from addresses that are not managed agents.

What happened#

On May 21, 2024, Ivanti shipped fixes for Endpoint Manager (EPM) and other products. Its May security update said there was no evidence of exploitation at the time. One of the fixes was CVE-2024-29824, an SQL injection in the EPM core server. The CVE record says it lets "an unauthenticated attacker within the same network" run arbitrary code on EPM 2022 SU5 and earlier. The CNA scores it CVSS 3.0 9.6 with an adjacent-network vector. NVD gives 8.8.

An anonymous researcher reported the bug through the Zero Day Initiative on April 3, 2024. ZDI-24-507 places it in the RecordGoodApp method and says code runs "in the context of the service account." Help Net Security notes it was one of ten SQL injection fixes Ivanti shipped that May. The fix was a hot patch that swaps five DLLs on the core server, followed by a restart or iisreset.

On June 12, 2024, Horizon3.ai published the root cause and a working exploit. PatchBiz.dll uses string.Format to place an attacker-supplied MD5 value into a SQL query. The vulnerable code is reachable without login through a web method hosted at /WSStatusEvents. From there, Horizon3 reached code execution with "a fairly trivial request using xp_cmdshell," which ran a program under sqlservr.exe.

In early October 2024, Ivanti updated its advisory. It said it "has confirmed exploitation of CVE-2024-29824 in the wild" against "a limited number of customers," BleepingComputer reported. CISA added the bug to the KEV catalog on October 2, with an October 23 deadline. Who exploited it, and what they deployed, was not disclosed as of Oct 23, 2026.

Who is affected#

EPM 2022 SU5 and earlier core servers without the May 2024 hot patch. Managed endpoints themselves are not the target. The core server is, along with the SQL Server behind it. The attacker needs network access to the core server, which usually sits inside the corporate network.

Do you really need to act?#

For this CVE alone, most teams patched in 2024. The bigger problem is the EPM 2022 line itself. SecurityWeek reports that EPM 2022 "has reached End of Life (EOL) and is no longer receiving security updates." Two later EPM flaws are also in KEV. CVE-2024-13159 and its siblings were added in March 2025. CVE-2026-1603, an unauthenticated leak of stored credential data, is fixed only in EPM 2024 SU5. It was added to KEV on March 9, 2026, per BleepingComputer. EPM pushes software to every managed machine, so a compromised core server is a path to the whole fleet. Hence the verdict: check exposure.

What to do now#

1. Record the EPM version and service update on every core server.
2. Upgrade anything on EPM 2022 to EPM 2024 SU5 or later.
3. Limit access to the core server's web services to managed endpoints and admin networks.
4. On the EPM database server, run SELECT name, value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell'; and disable the feature if nobody needs it.
5. If a core server sat unpatched between June and October 2024, investigate it and rotate the credentials EPM uses to manage endpoints.

How to tell if you were hit#

• Search SQL Server error logs and audit data for xp_cmdshell. Horizon3 points to this as the place to look, while noting it may not be the only route to code execution.
• Check EDR process trees for sqlservr.exe starting cmd.exe, powershell.exe or other programs.
• Review IIS logs on the core server for requests to /WSStatusEvents from addresses that are not managed agents.
• Look for EPM software distribution jobs or packages nobody on the team created.

Timeline#

• Apr 3, 2024 — The bug is reported to Ivanti through ZDI.
• May 21, 2024 — Ivanti ships the May security update with the EPM hot patch.
• May 24, 2024 — ZDI publishes ZDI-24-507.
• Jun 12, 2024 — Horizon3.ai publishes its analysis and exploit.
• Oct 2, 2024 — Ivanti confirms exploitation, and CISA adds the CVE to KEV.
• Mar 10, 2025 — CISA adds CVE-2024-13159, -13160 and -13161 to KEV.
• Mar 9, 2026 — CISA adds CVE-2026-1603 to KEV.

Vulnerability records

• CVE-2024-29824 · KEV 2024-10-02 · An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Ivanti — May Security Update (May 21, 2024) ivanti.com
2. Zero Day Initiative — ZDI-24-507: Ivanti Endpoint Manager RecordGoodApp SQL Injection Remote Code Execution Vulnerability zerodayinitiative.com
3. CVE record — CVE-2024-29824 cve.org
4. NVD — CVE-2024-29824 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-29824 cisa.gov
6. Horizon3.ai — CVE-2024-29824 Deep Dive: Ivanti EPM SQL Injection Remote Code Execution Vulnerability horizon3.ai
7. Horizon3.ai — CVE-2024-29824 proof of concept (GitHub) github.com
8. CVE record — CVE-2024-13159 cve.org
9. CVE record — CVE-2026-1603 cve.org

Coverage and analysis

1. BleepingComputer — Critical Ivanti RCE flaw with public exploit now used in attacks bleepingcomputer.com
2. Help Net Security — Critical Ivanti Endpoint Manager flaw exploited (CVE-2024-29824) helpnetsecurity.com
3. SecurityWeek — Ivanti patches Endpoint Manager vulnerabilities disclosed in October 2025 securityweek.com
4. BleepingComputer — CISA: Recently patched Ivanti EPM flaw now actively exploited bleepingcomputer.com