Patch Ivanti EPM **Now** to Block 13 Critical RCE Vulnerabilities

Multiple newly disclosed Remote Code Execution (RCE) flaws in Ivanti Endpoint Manager are being exploited in the wild. Delay is unacceptable.

Author: CyberDudeBivash — cyberbivash.blogspot.com | Published: Oct 15, 2025

TL;DR

• Ivanti EPM (Endpoint Manager) has at least **13 critical RCE vulnerabilities** disclosed recently, including CVE-2024-29847 and a brand new filename validation flaw CVE-2025-9872.
• Some of these vulnerabilities allow *unauthenticated* code execution on server or agents. :
• If your organization uses Ivanti EPM (2022 / 2024 branches), you must patch immediately to the minimum safe versions. 
• Later in this post: detection rules, mitigation steps, forensic actions, and a service CTA for vulnerability hardening.

---

What Are We Facing? The Ivanti EPM RCE Flaws

Here are some of the publicly known remote code execution (RCE) vulnerabilities targeting Ivanti EPM and related components: – **CVE-2024-29847** — A pre-authentication RCE in Ivanti EPM allowing arbitrary code execution without auth.  – **CVE-2023-39336** — SQL injection + RCE chain when configured with SQL Express; fixed in EPM 2022 Service Update 5.- **CVE-2025-9872** — Filename validation flaw in EPM that allows arbitrary code execution via crafted uploads.  – Various other high-severity RCEs in Ivanti’s RCE advisories (8+ more) documented in threat intelligence from Rewterz, CCB Belgium, etc.  – In the mobile side (EPMM), chained vulnerabilities **CVE-2025-4427** + **CVE-2025-4428** allow unauthenticated RCE via API chain. **Why this is critical:** EPM is often the central management console controlling endpoints, patches, policies, and agent deployment. If the core server or agents are compromised, attackers can gain broad control across your network. —

Immediate Actions: Patch & Mitigate

Below is a prioritized checklist you must act on **immediately**: 1. **Identify Your EPM versions** – Check whether your installation is under the **2022 branch** or **2024 branch**. – Note which Service Update (SU) or Security Update level you’re at. 2. **Review Ivanti’s official security advisory & release notes** – For CVE-2023-39336, Ivanti publicly confirmed the issue and fixed versions.  – For CVE-2025-9872, Ivanti has patched in EPM 2022 SU8 Security Update 2 and EPM 2024 SU3 Security Update 1. – For EPMM vulnerabilities (Mobile side), patch to EPMM 11.12.0.5, 12.3.0.2, 12.4.0.2, or 12.5.0.1 as applicable.  3. **Apply patches / upgrades** – If you are on **EPM 2022 ≤ SU5**, upgrade to **EPM 2022 SU5** or above. : – For 2024 branch, ensure you have the **SU3 Security Update 1** which includes fix for CVE-2025-9872.  – Validate patches in staging before production rollout. – Monitor logs during deployment; check for anomalous service restarts or failures. 4. **Temporarily disable risky features / endpoints (if patch delayed)** – Block or restrict file upload endpoints or API endpoints used by EPM that accept uploaded files. – Enforce stricter input validation on file names, types, sizes. – Use Web Application Firewall (WAF) or reverse proxy rules to sanitize / block malicious filename patterns (e.g. path traversal, dangerous extensions). 5. **Incident response and forensic snapshot** – Before applying patches, capture memory dumps, process listings, open file handles, driver modules, and agent state. – Look for suspicious processes, file upload logs, anomalous traffic to endpoints. – Check whether any of the newly patched RCEs may already have been exploited. 6. **Post-patch verification & audit** – Confirm the patched endpoints no longer respond to exploit tests (benign probes). – Validate agent connectivity, tasks, patch deployments. – Monitor for any abnormal behavior or new error logs. 7. **Ongoing monitoring & threat hunting** – Deploy IDS / NDR / WAF rules that detect exploit patterns for those CVEs. – Correlate network traffic anomalies with times of patch deployment or restarts. – Watch for new CVEs or proof-of-concept exploits to emerge. – Review logs for file upload with crafted names or abnormal activity in EPM logs. —

Detection & Hunt Queries (Template Ideas)

Use these as starting points in your SIEM / EDR hunts: – Searches for HTTP requests containing suspicious filename patterns (e.g. `../../`, `.exe`, `.jar`, `\u0000` nulls) to EPM upload APIs – Unexpected file write events in EPM server directories (e.g. `/wwwroot`, `/uploads`) – Executable file launches originating from EPM service context – Process creation by `w3wp.exe` or EPM backend executables not in expected version set – File hash changes in EPM binaries before/after patch – Outbound connections from EPM server to unknown hosts post patch – Audit logs of administrative config changes or system restarts during patching windows —

Service Offering: Rapid Hardening & Audit

If you need help ensuring your EPM environment is safe: “`html

Ivanti EPM Hardening & Remediation Service
We perform a full vulnerability audit, patch deployment automation, exploit checks, and ongoing monitoring. Book Hardening Audit Now

Affiliate Toolbox (clearly disclosed)

Disclosure: If you use these links, we may earn a commission at no extra cost.

• EDUREKA Security Courses
• Kaspersky Enterprise Suite

Tags: #CyberDudeBivash #Ivanti #CVE2025 #EndpointSecurity #ZeroDay #RCE #PatchNow #VulnerabilityManagement #CyberThreatIntel