An exposed dangerous method on the Core Server of Ivanti Endpoint Manager allows a remote authenticated attacker to leak access credentials. The flaw enables the attacker to retrieve valid credentials for other users or systems, potentially facilitating further unauthorized access. This vulnerability is an information disclosure weakness (CWE‑749) that arises from improper access restrictions on a sensitive method.

The vulnerability affects Ivanti Endpoint Manager Core Server deployments prior to version 2024 SU6. All releases before 2024 SU6 are potentially vulnerable. Users of earlier versions should consult the official Ivanti security advisory for details on the affected build and the recommended fix.

The CVSS score of 6.5 indicates a moderate severity assessment, and the lack of an available EPSS score provides no concrete exploitation probability data. Because the attack requires remote authenticated access, the threat is limited to insiders or compromised legitimate users unless additional weaknesses exist. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits as of the data available.