CVE-2024-50324: Path Traversal in Ivanti Endpoint Manager

Successful exploitation of CVE-2024-50324 grants an attacker the ability to execute arbitrary code on the Ivanti Endpoint Manager server. This could lead to complete system compromise, allowing the attacker to steal sensitive data, install malware, or pivot to other systems within the network. Given the administrative privileges required, an attacker who gains access could potentially control the entire endpoint management infrastructure, impacting all managed devices. The potential blast radius is significant, particularly in organizations heavily reliant on Ivanti Endpoint Manager for device management and security.

1. Reserved2024-10-22
2. Published2024-11-12
3. Modified2024-11-19
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-50324 is to immediately upgrade to the 2024 November Security Update or 2022 SU6 November Security Update. If upgrading is not immediately feasible, consider implementing network segmentation to limit the attacker's potential lateral movement. Restrict access to the Ivanti Endpoint Manager console to only authorized administrators. Implement strict authentication and authorization controls. Review and audit existing user accounts and permissions. After upgrading, verify the fix by attempting to access restricted files via the Endpoint Manager interface – access should be denied.