The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical vulnerability in Ivanti’s Endpoint Manager (EPM), tracked as CVE-2024-29824, which is being actively exploited by malicious threat actors to conduct remote code execution (RCE). This flaw, with a CVSS score of 9.6/10, is an SQL Injection vulnerability in the EPM’s Core server that allows unauthenticated attackers within the same network to execute arbitrary code on unpatched systems, exploiting how SQL queries are handled in a function called “RecordGoodApp()” within the “PatchBiz.dll” file. Ivanti released a patch in May 2024, but recent reports indicate that attackers are leveraging the vulnerability through “xp_cmdshell” commands. Horizon3.ai published a proof-of-concept (PoC) exploit in June, and Ivanti has since confirmed that a limited number of customers have been impacted. As a result, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog mandating that all Federal Civilian Executive Branch (FCEB) agencies patch no later than October 23, 2024. This is the fourth Ivanti vulnerability exploited within a month, highlighting the increasing threat landscape. Given Ivanti’s widespread use across over 40,000 companies globally, organizations are urged to prioritize patching to safeguard their systems from ongoing attacks. CTIX analysts recommend that any affected users ensure their Ivanti EPM is running the most recent patch.