SQL injection in the web console of Ivanti Endpoint Manager allows a remote authenticated attacker to gain code execution privileges on the affected system. The flaw enables arbitrary SQL commands to be executed against the underlying database, which can be leveraged to read or modify data, inject malicious payloads, and ultimately run arbitrary code. This satisfies the definition of a true remote code execution vulnerability and is identified as CWE-89.

The vulnerability affects Ivanti Endpoint Manager versions released before 2024 SU6. Any installation that has not been updated to 2024 SU6 or later is susceptible.

The CVSS score of 8.8 indicates high severity. The exploit requires victim authentication to the web console, so it is not publicly exploitable without credentials. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, because remote code execution is possible, the risk remains significant, especially if the web console is reachable from untrusted networks.