The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-29824 (CVSS 9.6) to its Known Exploited Vulnerabilities catalog after Ivanti confirmed active in-the-wild exploitation of the flaw in Endpoint Manager (EPM) Core servers running 2022 SU5 and earlier. The critical vulnerability originates in the RecordGoodApp() function within the PatchBiz.dll library. Unauthenticated network attackers can send specially crafted HTTP POST requests to the /WSStatusEvents/EventHandler.asmx SOAP web service, where user-supplied parameters such as goodApp.md5 are concatenated directly into backend SQL queries without sanitization.

Exploiting this SQL injection primitive allows adversaries to interact directly with the backend Microsoft SQL Server database, reconfigure server options via sp_configure, and invoke the xp_cmdshell extended stored procedure to spawn OS commands under the database service account or NT AUTHORITY\SYSTEM. Following public release of proof-of-concept exploit code by Horizon3.ai and weaponization in Metasploit, attackers began targeting exposed appliances to stage secondary payloads and pivot laterally. Ivanti released remediation hotfixes in EPM 2022 SU6 and EPM 2024, while CISA mandated that federal civilian agencies remediate exposed installations.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated SQL injection into an enterprise management core immediately collapses boundary segmentation, allowing unauthenticated network actors to elevate from web service input to OS-level SYSTEM command execution via database stored procedures.
• Bullet 2 — Strategic & Defender Imperative: Security teams must immediately apply Ivanti EPM 2022 SU6 or EPM 2024 updates, isolate Core server management ports from untrusted networks, disable xp_cmdshell across SQL Server instances, and audit database transaction logs for anomalous process execution.