CVE-2024-29847

critical

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to a…

Vendor / product: Ivanti — endpoint manager

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2024-09-12 02:15

Modified: 2026-11-04 00:17

NVD status: Modified

Last synced 23 hours ago

Verified against the source API 2026-11-04 00:25 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

ivanti / endpoint_manager <2022, 2022, 2024

Weakness classification (CWE)

CWE-502

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-... support@hackerone.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 00:25 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2024-29847

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs