CVE-2024-37397

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

Affected

Ivanti · EPM

CVSS v3.1 CNA

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS v3.0 HACKERONE

8.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

59.26% chance of exploitation in the next 30 days, 99th percentile

Published

2024-09-12

Updated

2024-09-13

Proof-of-concept exploits (1)

• pwnfuzz/cve-pocs57★ · 2026-01-04

Security advisories

• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and…

References

• CVE Record
• NVD entry

Related

• CVE-2025-2263
• CVE-2025-68615