Ivanti fixes maximum severity RCE bug in Endpoint Management software

Ivanti patched a critical unauthenticated RCE vulnerability (CVE-2024-29847) in Ivanti Endpoint Management stemming from unsafe deserialization in the agent portal; hot patches and EPM 2022 SU6 fixes were released. The company reports no known active exploitation of this specific flaw at disclosure but also addressed nearly two dozen other high/critical issues, and the advisory contextualizes this release within recent in-the-wild exploitation of other Ivanti zero-days affecting many customers.