How do you patch or mitigate CVE-2024-29824 (Ivanti Endpoint Manager (EPM) SQL Injection)?

CISA’s required action for CVE-2024-29824 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Endpoint Manager (EPM) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

How to treat CVE-2024-29824 as a live exposure problem

For this issue, the practical question is not whether the CVE exists, but whether any Ivanti Endpoint Manager deployment is still reachable or still running in a state where the vendor mitigation can be applied. SQL injection flaws are dangerous because the application often turns attacker-controlled input directly into database queries, so the first task is to locate every EPM instance and determine which ones are externally exposed or operationally critical.

That exposure check matters most for internet-facing management surfaces, test systems that mirror production credentials or data, and forgotten instances that remain reachable long after they stopped being actively managed. If the product is still in service, the safest assumption is that it must be treated as a patch-or-remove decision, not as a monitor-only event.

What to do when the vendor fix is available

The preferred path is to apply the vendor security update or mitigation exactly as documented, then confirm that the vulnerable service is no longer reachable in the same way from the network path that was originally exposed. For patchable enterprise software, the real risk is not just missing the update, but leaving one deployment on an older build while the rest of the estate moves forward, especially when asset inventories and ownership are incomplete.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to verify the required action, then validate the result from the outside in. If you manage remediation at scale, a broader vulnerability management guide is useful for the surrounding workflow, especially for scope, prioritisation, exception handling, and closure evidence.

What to do if you cannot patch right away

If you cannot apply the mitigation immediately, reduce exposure rather than waiting for a convenient maintenance window. The immediate control is to remove internet access, restrict management-plane reachability to trusted administration paths, and keep the vulnerable system from accepting untrusted traffic until you can complete the documented fix. If neither containment nor mitigation is feasible, discontinue use of the product.

That fallback is important because SQL injection is usually exploitable through a narrow input path, which means partial exposure can still be enough for compromise. Even when the vulnerable function is not obviously public, any reachable administrative interface, API, or integration point should be treated as part of the attack surface until proven otherwise.

Risk and Threat Considerations

A SQL injection flaw in a management product creates more than application risk, it can become an estate-wide trust problem if the vulnerable instance has access to credentials, configuration data, or database contents that are broader than the application itself. If the product is internet exposed, attackers can probe it repeatedly until they find a usable injection path, then use that foothold to access data or pivot deeper into the environment.

Failure mechanism: The application accepts attacker-controlled input and embeds it in database logic, allowing unauthorized query manipulation when the affected endpoint is reachable and unprotected.

Impact: Successful exploitation can expose or alter backend data, weaken administrative trust in the platform, and force emergency containment if the product sits on a privileged management path.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	SQL injection risk is directly about unsafe input handling.
	RA-5 — Vulnerability Monitoring and Scanning	This CVE requires finding exposed instances and confirming remediation status.
Recommendation — Validate all untrusted input before it reaches database queries. Scan for Ivanti EPM exposure and verify the fix is present everywhere.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed flaws require rapid identification, prioritisation, and remediation.
Recommendation — Prioritise and remediate the vulnerable product using an exposure-based workflow.
OWASP ASVS	V1 — Encoding and Sanitization	SQL injection is a classic input handling failure addressed by ASVS validation guidance.
Recommendation — Apply strict input handling and query parameterisation for database-facing inputs.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The answer centers on finding, fixing, and verifying a known exploited vulnerability.
Recommendation — Track the flaw through a formal remediation and verification process.

Practitioner Guidance

What to verify: Confirm every EPM instance, its network exposure, and whether the documented vendor mitigation has actually been applied in the live path that handles requests. Do not rely on change tickets alone, verify from the outside that the vulnerable surface is no longer reachable or that the patched service is the only one answering.

Escalation / exception: If a system cannot be patched, cannot be safely isolated, or continues to expose a management interface to untrusted networks, treat that as an operational exception requiring shutdown or removal rather than an accepted residual risk.

Practitioner takeaway: For a KEV-listed SQL injection in a management product, speed matters less than certainty, because a partially remediated instance with residual exposure is still a viable compromise path.