Overview
Ivanti has released critical security updates addressing four severe vulnerabilities in Endpoint Manager (EPM) with a CVSS score of 9.8. The company has proactively patched these flaws along with additional issues in Avalanche and Application Control Engine products. No active exploitation
Whom it may concern
- Enterprise IT Security teams
- Ivanti EPM administrators
- Security operations personnel
- Compliance officers managing endpoint security
Key Findings
- Critical authentication bypass vulnerabilities affecting EPM versions 2024 and 2022
- Patches available through January-2025 Security Updates
- Multiple high-severity issues in Avalanche (pre-6.4.7) and ACE (pre-10.14.4.0)
- Enhanced internal security testing procedures implemented
Action Items
- Immediately update EPM to January-2025 Security Update
- Deploy Avalanche version 6.4.7 or newer
- Upgrade ACE to version 10.14.4.0
- Review system logs for potential compromise indicators
- Implement enhanced access controls
Sources
- [The Hacker News](https://thehackernews.com/2025/01/researcher-uncovers-critical-flaws-in.html)