CVE-2024-8320: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

CVE-2024-8320 is a security vulnerability affecting Ivanti Endpoint Manager (EPM) versions before 2022 SU6 and the 2024 version prior to the September update. The vulnerability stems from missing authentication in the Network Isolation feature, which was discovered and disclosed in August 2024 (NVD).

The vulnerability is classified as a Missing Authentication for Critical Function (CWE-306) issue. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

When exploited, this vulnerability allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices. This could potentially lead to misrepresentation of security states and compromise the integrity of network isolation mechanisms (CIS Advisory).

Organizations should immediately update their Ivanti EPM installations to version 2022 SU6 or apply the 2024 September update, depending on their deployed version. The vulnerability has been addressed in these releases (CIS Advisory).