cbcvebase.
CVE-2024-8322
published 2024-09-10

CVE-2024-8322: Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted…

PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.08%
61.0th percentile
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.

Affected

3 ranges
VendorProductVersion rangeFixed in
ivantiendpoint_manager< 20222022
ivantiendpoint_manager——
ivantiendpoint_manager——

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability exists in Patch Management component of Ivanti EPM; monitor for authenticated remote access attempts to restricted Patch Management functionality on unpatched versions (before 2022 SU6 or the 2024 September update) ↗
  • ·Affected versions are Ivanti EPM before 2022 SU6 or before the 2024 September update; upgrade to 2022 SU6 or apply the 2024 September update to remediate ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.