What happened?
On 16 October 2024, Ivanti published an advisory that read like most of its year had: two vulnerabilities in Ivanti Endpoint Manager, one of them critical, both demanding same-week patching. The flaws – an improper-authentication issue rated 9.6 and a server-side request forgery path rated 7.2 – were dangerous independently and worse in combination, with the vendor itself warning that chaining them could end in remote code execution on the EPM core server: the machine that administers endpoints across an entire enterprise. When this post publishes on 31 October 2024, patches are out, Ivanti says it has seen no evidence of active exploitation in the wild, and the industry is halfway through a grace period it knows from experience will be measured in days before scanners find every unpatched core on the internet. For a vendor already famous for ten months of consecutive crises, an October endpoint-management emergency was less a surprise than a redemption-arc test.
Quick Answer: Ivanti Endpoint Manager (EPM) – the client-server suite that inventories, patches, and controls fleets of corporate endpoints – shipped with two flaws disclosed on 16 October 2024. CVE-2024-29224 (CVSS 9.6) is an improper authentication vulnerability that lets an unauthenticated remote attacker bypass authentication and reach restricted functionality on the EPM core server. CVE-2024-29226 (CVSS 7.2) is a server-side request forgery issue in the same product. Ivanti warned that an attacker who combined the two could achieve remote code execution on the core server – the administrative heart of the endpoint fleet. Fixes shipped with the disclosure; at announcement time Ivanti reported no evidence of in-the-wild exploitation, but the vendor and outside analysts both urged immediate patching given how quickly Ivanti flaws have historically transitioned from advisory to mass scanning.
The architecture explains the alarm. Endpoint management platforms occupy one of the most powerful positions in an enterprise: they hold agent deployments, credential material, software packages, and tasking for every machine they manage. A core server compromise is therefore not one-box damage – it is fleet damage, the difference between burglarizing a house and receiving the keys to every house on the block. That is why the CVSS arithmetic, which already rated the authentication bypass near-perfect, understated the practical stakes: the score prices the single system, while attackers price the estate behind it. The advisory pattern – unauthenticated entry plus a request-forgery pivot plus a stated RCE chain – is precisely the shape of tooling that gets commoditized within weeks of disclosure.
The paper trail
| Date | Event |
|---|---|
| 2024-01→02 | Ivanti Connect Secure VPN zero-days (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) set off a year of crisis response across thousands of VPN appliances; mass compromise and re-compromise reports follow |
| 2024-09-03 | Critical Ivanti Cloud Service Appliance RCE (CVE-2024-8190) disclosed with active-exploitation warnings – the immediate prelude to October |
| 2024-10-16 | Ivanti discloses CVE-2024-29224 (9.6, improper authentication) and CVE-2024-29226 (7.2, SSRF) in Endpoint Manager, warns of a chain enabling core-server RCE, ships fixes |
| 2024-10-16→24 | Migration guidance and scanner signatures circulate; security teams inventory exposed EPM core consoles; no public exploitation evidence reported |
| 2024-10-31 | This post publishes with the patch grace period closing and Ivanti closing out a brutal disclosure year still on its feet |
Chaining to the core
Neither flaw alone tells the whole story, and Ivanti was unusually direct in saying so. The authentication bypass is the door: an unauthenticated remote attacker reaching functionality that should demand credentials gets to interact with the server as a trusted party. The SSRF is the corridor: coercing the server itself to make requests it never intended to make, toward destinations the attacker chooses. Joined, they form the classic management-console takeover pattern – authenticate as nobody, redirect as somebody, execute as the server. What made the chain operationally urgent was position rather than novelty: EPM cores speak to every endpoint agent, so code execution there can mean package tampering, tasking abuse, or credential harvesting at fleet scale. Defense planning that treats the core console as “just another internal server” misprices it by an order of magnitude – it is a control plane, and October’s advisory said so in CVSS language.
Crisis vendor, crisis month
The uncomfortable backdrop is that this was Ivanti’s fourth high-stakes disclosure cycle inside ten months. January’s Connect Secure zero-days – authenticated by the malware discoveries on appliances thought clean – taught the industry two lessons: Ivanti products are heavily deployed exactly where attackers want to be, and patching alone does not evict an intruder who has already moved in. September’s Cloud Service Appliance RCE repeated the motif with warnings of active exploitation. By October, security teams treated the EPM advisory not as an isolated event but as episode four of a season, with the same muscle memory: patch, rotate, hunt for indicators, assume persistence until proven otherwise. The vendor, to its credit, had by late 2024 adopted faster disclosure cadence and more candid chaining language – the EPM advisory plainly naming the RCE combination was itself a small culture shift from the opaque advisories of the winter.
What defenders actually did
The response playbook wrote itself from the prior episodes. First, inventory: find every EPM core, including legacy installs and lab consoles nobody remembered. Second, isolate: the management interface has no legitimate audience on the open internet, and exposure scanners found a nontrivial number of reachable consoles within days of disclosure. Third, patch to the fixed releases – non-negotiable given the stated chain. Fourth, hunt: review core-server logs for unexplained authentication successes, odd outbound connections consistent with SSRF discovery, and new or modified packages and tasking, looking back to before the disclosure. Fifth, rotate: credentials, certificates, and agent trust material the core holds, because a hypothetical prior compromise would survive the patch. The teams that had already built this loop during the VPN crises executed it in hours; the ones starting from scratch learned why the veterans kept the runbook open.
- Endpoint managers are control planes: a core-server flaw prices as one CVE but lands as fleet-wide compromise; patch priority should follow architecture, not just score.
- Vendor track record is threat intelligence: after a year of Ivanti appliance crises, an EPM critical demanded same-week action on that basis alone – attacker attention was proven, not hypothetical.
- Chained bugs price higher than their parts: 9.6 plus 7.2 with a vendor-confirmed RCE chain is operationally a 10; triage queues that sort by single-CVE score will always run late.
- No-exploitation is a timestamp, not a status: “no evidence in the wild” at disclosure historically decays fast for internet-exposed management gear – the grace period is for patching, not deliberation.
FAQ
Was the Ivanti Endpoint Manager flaw exploited like the VPN bugs were?
At disclosure, no – and that is the careful phrasing every serious report used. Ivanti stated it had no evidence of active exploitation for either EPM vulnerability when it shipped fixes on 16 October 2024. The urgency came from structure rather than incident: an unauthenticated entry flaw, a vendor-confirmed RCE chain, internet-exposed consoles, and a year in which Ivanti products had been systematically targeted. The industry’s working assumption – born of January’s VPN experience – was that scanner interest would arrive quickly, making the patch window the only variable worth managing.
What do the two CVEs actually let an attacker do?
CVE-2024-29224 is an improper authentication weakness: an unauthenticated remote attacker can bypass authentication and access restricted functionality on the EPM core server – effectively interacting with management capabilities intended for credentialed administrators. CVE-2024-29226 is a server-side request forgery flaw: the server can be manipulated into making attacker-directed requests. The disclosure warned the two could be chained toward remote code execution on the core server, which is why a 9.6-plus-7.2 pair carried ten-point urgency in practice: the combination hands over the machine that commands the endpoint fleet.
What should an EPM deployment have done in October 2024?
Patch to the fixed release immediately, and in the same change window remove the EPM core console from any internet exposure – management planes belong on VPN-restricted or allow-listed access. Then hunt and harden: review authentication and outbound-connection logs on the core for anomalies predating the patch, rotate credentials and agent trust material the server holds, and confirm package repositories and tasking show no unauthorized additions. Finally, fold EPM into the quarterly exposure review alongside the VPN and CSA lessons of 2024 – the year’s throughline was that every Ivanti control surface needs a standing assume-breach check, not an annual one.
Legacy: the year Ivanti taught defense-in-priority
The EPM advisory closed Ivanti’s 2024 disclosure calendar with the theme the whole year had been writing: management and access infrastructure is the real perimeter, and its vendors’ worst months become everyone’s incident retrospectives. October’s flaw was disclosed faster, phrased more plainly, and patched more smoothly than January’s – evidence that crisis can reform process – but the burden it left with customers was identical: patching is the beginning of recovery, not the end. Enterprises that treated every Ivanti advisory as a control-plane emergency finished the year tired but intact; those that treated them as routine CVE queue items spent the year discovering what “re-compromised after remediation” means. Endpoint management, VPN termination, cloud appliances – the lesson generalized far past one vendor: whatever commands the fleet is the crown jewel, and October put that lesson on every worklist at once.
