The vulnerability is an incorrect permissions assignment in the Ivanti Endpoint Manager agent, classified as CWE‑732, which allows a user who is already logged in locally to obtain higher privileges. The flaw does not provide any remote access or arbitrary code execution out of the box; it simply elevates the authenticated user’s effective rights within the system.

All installations of Ivanti Endpoint Manager running any build earlier than the 2024 SU6 release are affected. The issue resides in the agent component that executes on managed endpoints. Versions updated to 2024 SU6 or later contain the fixed permissions logic.

The CVSS score of 7.8 indicates a high‑severity vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation yet. The required local authentication limits the attack surface, but once promoted, the attacker could fully compromise the endpoint if desired.