Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager

Multiple critical vulnerabilities were disclosed and patched across several products: Ivanti Endpoint Manager (multiple SQL injection flaws enabling potential unauthenticated or authenticated remote code execution), Avalanche (file upload RCE), Neurons for ITSM (SQL injection and unrestricted file upload), Connect Secure (CRLF injection), Secure Access clients (local privilege escalation), and a path-traversal RCE in the open-source Netflix Genie prior to 4.3.18. Vendors released fixes and noted limited/no evidence of exploitation for the Ivanti issues, while maintainers warned Genie OSS instances that store attachments on the local filesystem are at risk of arbitrary file write and potential RCE.