CVE-2025-62387 - SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database

MEDIUM

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database

Published Oct 13, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 1.73%

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34104		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025		Vendor Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner ivanti

Published Oct 13, 2025

Updated Feb 10, 2026

Reserved Oct 10, 2025

Updated Nov 24, 2025

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner ivanti

Published Oct 13, 2025

Updated Feb 10, 2026

Exploited since n/a