Ivanti has patched multiple critical vulnerabilities in its Endpoint Manager (EPM), including six (6) SQL injection flaws (CVE-2024-29822 to CVE-2024-29827) that allow unauthenticated remote code execution and four (4) similar flaws (CVE-2024-29828 to CVE-2024-29846) requiring authentication, affecting versions 2022 SU5 and earlier. A high-severity flaw, tracked as CVE-2024-29848, in Avalanche also permits remote code execution via a maliciously crafted file. Additionally, vulnerabilities in Neurons for ITSM, Connect Secure, and Secure Access clients were fixed. Netflix’s Genie engine has a critical path traversal flaw (CVE-2024-4701) that can lead to remote code execution by exploiting its REST API to write arbitrary files. These disclosures, emphasizing secure design practices, coincide with warnings about other critical vulnerabilities like those in Honeywell’s Control Edge UOC, which can lead to full control of the controller via unauthenticated remote code execution. CTIX analysts recommend that all administrators responsible for the affected products ensure that their software is up-to-date with the latest patches to prevent future exploitation.