Ivanti warns critical EPM bug lets hackers hijack enrolled devices

Ivanti patched a critical pre-auth SQL injection vulnerability (CVE-2023-39336) in Endpoint Management allowing unauthenticated attackers on internal networks to execute arbitrary SQL and potentially gain control of enrolled devices or achieve remote code execution on the core server; the issue affects all supported EPM versions and was fixed in 2022 Service Update 5. The report also highlights past zero-day Ivanti vulnerabilities exploited by state-affiliated actors against government organizations, underscoring elevated risk to large numbers of organizations that use Ivanti products.