CISA adds Ivanti Endpoint Manager unauthenticated SQL injection flaw to KEV catalog
What happened.CISA ordered federal civilian agencies to patch a critical unauthenticated SQL injection vulnerability in Ivanti Endpoint Manager core servers.
Why it matters.Endpoint management servers centralize software distribution, system inventory, and administrative credentials across enterprise networks. When SQL injection defects grant unauthenticated remote code execution on core controllers, intruders compromise internal domain assets. Infrastructure administrators must update Ivanti Endpoint Manager to version 2024 SU8 immediately. Organizations should restrict administrative console access to dedicated internal networks.