Executive brief
Ivanti Endpoint Manager is a centralized platform used by IT departments to manage and secure various devices across a corporate network. A vulnerability in the software's agent component allows a user who already has limited access to a computer to gain full administrative control. This could allow an attacker to bypass security restrictions, access sensitive data, or disrupt business operations on the affected machine.
Technical details
A privilege escalation vulnerability exists in the Ivanti Endpoint Manager (EPM) agent due to incorrect permission assignments (CWE-732) for critical resources. A local attacker with low-privileged authenticated access can exploit these weak permissions to elevate their privileges to a higher level, potentially gaining full system control. The vulnerability affects all versions of Ivanti EPM prior to 2024 SU6. Users are advised to update to version 2024 SU6 or later to remediate the issue.
Affected products
- Ivanti Endpoint Manager (EPM) Before 2024 SU6
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Vendor advisory published by Ivanti