US-based software provider Ivanti has released a patch for a critical vulnerability in their Endpoint Manager (EPM) solution that could be exploited by threat actors to conduct remote code execution (RCE). Ivanti, the asset management software system, is used by organizations to remotely manage and inventory desktop computers. The flaw, tracked as CVE-2023-39336, is an SQL injection vulnerability which if exploited, could allow attackers who’ve gained access to the internal network to execute arbitrary SQL queries retrieving the output without the need for authentication. If successfully exploited, this flaw could allow the attacker to take complete control over any machines running the Ivanti EPM agent. Also, if the core server is configured for Microsoft SQL Express, exploitation may lead to RCE on the core server. Currently, there is no indication that this vulnerability is under active exploitation, but Ivanti zero-day EPM vulnerabilities have been exploited in the past. CTIX analysts recommend that all administrators responsible for instances of Ivanti EPM ensure that they are patching any vulnerable servers to prevent any future exploitation of this flaw.