Ivanti fixes critical security flaw that could let hackers hijack work devices, so patch now

A digital padlock on a blue digital background.
(Image credit: Shutterstock / vs148)

Ivanti has addressed a critical vulnerability in one of its products which could have allowed threat actors to drop all kinds of malware on flawed endpoints. 

As per an advisory released by the company earlier this week, the flaw is a remote code execution (RCE) vulnerability found in its Endpoint Management Software (EPM), BleepingComputer reported.

By abusing the flaw, threat actors could hijack enrolled devices or even the core server. The vulnerability is now tracked as CVE-2023-39336, and affects all supported EPM versions. If your organization is using the software, make sure to update it to version 2022 Service Update 5. 

No evidence of abuse

To abuse the flaw, the attackers don’t require special privileges, or even user interaction. The only thing they need is access to the target’s internal network. "If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication," Ivanti says. "This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server."

The good news is that Ivanti was proactive about the flaw. There is no evidence of hackers abusing it in the wild, or client complaints of hacking attempts. Further details about the flaw, found in the advisory, are currently unavailable, likely to give most customers a chance to apply the patch before other threat actors learn about the hole.

Ivanti’s EPM is a unified platform designed to help businesses manage user profiles and client devices. It supports Windows, macOS, Linux, Chrome OS, and different IoT platforms. It also comes with Day Zero support, promising swift management without loss of functionality, or downtime.

The company counts more than 40,000 clients around the world.

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Representational image depecting cybersecurity protection
Ivanti reveals major security update, so make sure you're protected
vpn
Ivanti warns another critical security flaw is being attacked
A person at a laptop with a cybersecure lock symbol floating above it.
Hackers are still using old Ivanti bugs to break into networks
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
A person's fingers type at a keyboard, with a digital security screen with a lock on it overlaid.
Veeam backup software has a serious security flaw - here's how to stay safe
Flag of the People's Republic of China overlaid with a technological network of wires and circuits.
One of the biggest flaws exploited by Salt Typhoon hackers has had a patch available for years
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone's hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI