CVE-2024-37397: Ivanti Endpoint Manager

High severity, CVSS 8.2. EPSS: 59.3% chance of exploitation in the next 30 days.

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

Affected products

• Ivanti Endpoint Manager: before 2022 (fixed in 2022); version 2022 only

Published 2024-09-12. Last modified 2026-06-17.