Enterprise software provider Ivanti on Thursday warned of a critical-severity vulnerability in its Endpoint Manager product that could be exploited for remote code execution.
Successful exploitation of the vulnerability, Ivanti notes in its advisory, could allow the attacker to take over devices running the EPM agent.
CVE-2023-39336 impacts EPM 2022 Service Update 4 and all prior versions, including EPM 2021 iterations, the company explains.
The US-based software provider has not made further details on the flaw available publicly, instead limiting access to customers only, likely to provide them with more time to apply the patches.
Ivanti makes no mention of the vulnerability being targeted in the wild, but security defects in its products are known to have been exploited in malicious attacks, including as zero-days.
One of the most recent such examples is CVE-2023-38035, a critical-severity issue in Ivanti's Sentry mobile gateway.
It was patched in late August 2023, after being exploited as a zero-day against some of the company's customers.
Ivanti addressed CVE-2023-35078 and CVE-2023-35081, two exploited bugs in its Endpoint Manager Mobile product.
Both issues had been exploited as zero-days, likely by state-sponsored attackers, with CVE-2023-35078 likely exploited since at least April 2023, in attacks targeting the Norwegian government.
This Cyber News was published on www.securityweek.com. Publication date: Fri, 05 Jan 2024 12:43:04 +0000