CVE-2025-62389 - SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database

MEDIUM

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database

Published Oct 13, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 1.74%

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34106		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025		Vendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ivanti

Published Oct 13, 2025

Updated Feb 10, 2026

Reserved Oct 10, 2025

CISA Vulnrichment

Updated Oct 14, 2025

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner ivanti

Published Oct 13, 2025

Updated Feb 10, 2026

GitHub

No data