<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Endpoint Manager (EPM) vulnerability to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> the Ivanti Virtual Traffic Manager authentication bypass vulnerability CVE-2024-29824<\/a> (CVSS score of 9.6) to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n

In May, Ivanti rolled out<\/a> security patches to address multiple critical vulnerabilities in the Endpoint Manager (EPM), including CVE-2024-29824.<\/gwmw><\/p>\n\n\n\n

The vulnerability CVE-2024-29824<\/a> is an unspecified SQL Injection issue in Core server of Ivanti EPM\u00a02022 SU5 and prior. An unauthenticated attacker within the same network could exploit the vulnerability to execute arbitrary code.<\/p>\n\n\n\n

At the time of its disclosure, the company reported that it was not aware of attacks in the wild exploiting the vulnerability.<\/p>\n\n\n\n

According to\u00a0Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

CISA orders federal agencies to fix this vulnerability by\u00a0October 23, 2024.<\/p>\n\n\n\n

Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/gwmw><\/p>\n\n\n\n

Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, CISA<\/a>)<\/strong><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Endpoint Manager (EPM) vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added the Ivanti Virtual Traffic Manager authentication bypass vulnerability CVE-2024-29824 (CVSS score of 9.6) to its Known Exploited Vulnerabilities (KEV) catalog. In May, Ivanti rolled out security patches to […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[8913,4112,9508,9506,10918,14797,12584,687,841,1533],"class_list":["post-169279","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-cisa","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-ivanti-endpoint-manager","tag-known-exploited-vulnerabilities-catalog","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n