CVE-2025-62387: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

SQL injection vulnerability (CVE-2025-62387) was discovered in Ivanti Endpoint Manager that allows a remote authenticated attacker to read arbitrary data from the database. The vulnerability was disclosed on October 13, 2025 and affects Ivanti Endpoint Manager versions 2024 SU3 SR1 and prior (NVD, GBHackers).

The vulnerability is classified as a SQL injection (CWE-89) with a CVSS v3.1 base score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates the vulnerability requires network access, low attack complexity, low privileges, no user interaction, has unchanged scope, and can impact confidentiality but not integrity or availability (NVD, GBHackers).

The vulnerability allows authenticated attackers to read arbitrary data from the database, potentially exposing sensitive information stored within the Ivanti Endpoint Manager system (CIS Advisory).

Ivanti has announced that fixes for the SQL injection vulnerabilities, including CVE-2025-62387, will be released in EPM 2024 SU5 planned for Q1 2026. As a temporary mitigation, administrators can remove the Reporting database user to eliminate exposure, though this will disable reporting functionality. Organizations are advised to upgrade to Ivanti EPM 2024 and implement strict least-privilege access controls (GBHackers).