Ivanti and Zyxel Release Urgent Patches for Critical Vulnerabilities

September 12, 2024

Ivanti and Zyxel Release Urgent Patches for Critical Vulnerabilities

Ivanti has rolled out crucial software updates aimed at mitigating multiple vulnerabilities in its Endpoint Manager (EPM) software, targeting a spectrum of security flaws that could potentially jeopardize user data and system integrity. Among these, a particularly severe deserialization of untrusted data vulnerability (CVE-2024-29847) stands out with a CVSS score of 10.0, indicating its critical nature and the potential for remote unauthenticated attackers to execute arbitrary code. This is a significant concern as such vulnerabilities can open the door for various forms of cyberattacks, from data breaches to system takeovers.

In addition to this critical flaw, Ivanti has also patched several unspecified SQL injection vulnerabilities (CVE-2024-32840, -32842, -32843, -32845, -32846, -32848, -34779, -34783, and -34785), each carrying a CVSS score of 9.1. These vulnerabilities are particularly menacing as they allow an authenticated attacker with administrative privileges to potentially execute remote code, thus gaining unauthorized access and control over affected systems. The vulnerable versions include EPM 2024 and 2022 SU5 and earlier, with the issues addressed in the newly released versions 2024 SU1 and 2022 SU6. Ivanti emphasizes the urgency of upgrading to these latest versions to mitigate risks.

Significance of Prompt Updates

The release of these software updates underscores the urgent need for organizations using Ivanti’s products to promptly upgrade to the latest versions to protect against these identified flaws. To date, Ivanti has confirmed that there have been no reports of active exploitation of these vulnerabilities in the wild. Nevertheless, the swift response to these issues highlights a proactive approach following the exploitation of zero-day vulnerabilities in Ivanti products, particularly by cyber espionage groups with ties to China. These groups’ activities underscore the increasingly sophisticated threats organizations face in today’s cybersecurity landscape.

Ivanti’s quick action in issuing these patches highlights the company’s commitment to its users’ security. In addition to releasing updates for EPM, Ivanti has rectified seven high-severity vulnerabilities in Ivanti Workspace Control (IWC) and Ivanti Cloud Service Appliance (CSA). To bolster its security posture, Ivanti has increased its internal scanning and manual testing protocols. Furthermore, the company has refined its responsible disclosure process, facilitating the increased identification and resolution of vulnerabilities. These measures are a testament to Ivanti’s dedication to fortifying its software and protecting its customers from evolving cyber threats.

Broader Cybersecurity Measures

Ivanti has released critical software updates to address multiple vulnerabilities in its Endpoint Manager (EPM) software. These updates target a variety of security flaws that could compromise user data and system integrity. Notably, a severe deserialization of untrusted data vulnerability (CVE-2024-29847) has been identified, with a maximum CVSS score of 10.0. This vulnerability is particularly dangerous as it allows remote unauthenticated attackers to execute arbitrary code, posing significant risks of data breaches and system takeovers.

Additionally, Ivanti has fixed several unspecified SQL injection vulnerabilities (CVE-2024-32840, -32842, -32843, -32845, -32846, -32848, -34779, -34783, and -34785), each with a CVSS score of 9.1. These SQL injection flaws are perilous because they enable an authenticated attacker with admin privileges to execute remote code, thereby gaining unauthorized access to systems. The affected versions include EPM 2024 and 2022 SU5 and earlier, with patches provided in versions 2024 SU1 and 2022 SU6. Ivanti stresses the urgency of upgrading to these latest versions to mitigate these serious security risks.

Explore more

Global RPA Market Set for Rapid Growth Through 2033

March 2, 2026

The modern business environment has reached a definitive turning point where the distinction between human administrative effort and automated digital execution is blurring into a singular, cohesive workflow. As organizations navigate the complexities of a post-pandemic economic landscape in 2026, the reliance on Robotic Process Automation (RPA) has transitioned from a competitive advantage to a fundamental requirement for survival. This

US Labor Market Cools Following January Employment Surge

March 2, 2026

The sheer magnitude of the employment surge witnessed during the first month of the year has left economists questioning whether the American economy is truly overheating or simply experiencing a statistical anomaly. While January provided a blowout performance that defied most conservative forecasts, the subsequent data for February suggests that a significant cooling period is finally taking hold. This shift

Trend Analysis: Entry Level Remote Careers

March 2, 2026

The long-standing belief that securing a high-paying professional career requires a decade of office-bound grinding is being systematically dismantled by a digital-first economy that values specific output over physical attendance. For decades, the entry-level designation often implied a physical presence in a cubicle and years of preparatory internships, yet fresh data suggests that high-paying remote opportunities are now accessible to

How to Bridge Skills Gaps by Developing Internal Talent

March 2, 2026

The modern labor market presents a paradoxical challenge where specialized roles remain vacant for months while thousands of capable employees feel their professional growth has hit an impenetrable ceiling. This misalignment is not merely a recruitment issue but a systemic failure to recognize “adjacent-fit” talent—individuals who already possess the vast majority of required competencies but are overlooked due to rigid

Is Physical Disability a Barrier to Executive Leadership?

March 2, 2026

When a seasoned diplomat with a career spanning the United Nations and high-level corporate strategy enters a boardroom, the initial assessment by peers should theoretically rest upon a decade of proven crisis management and multi-million-dollar partnership successes. However, for many leaders who live with visible physical disabilities, the resume often faces an uphill battle against a deeply ingrained societal bias.