CVE-2023-39336 is a high severity (CVSS 8.8) SQL injection in Ivanti Endpoint Manager releases prior to 2022 SU 5. An attacker with access to the internal network can run arbitrary SQL queries without authenticating, and in some circumstances this can lead to remote code execution on the core server. Update to 2022 SU 5 or later.
What's affected
The NVD record names Ivanti Endpoint Manager releases prior to 2022 SU 5, and lists the 2022 base release and 2022 SU1 among the affected versions. The record scores it 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means adjacent network access, no privileges and no user interaction.
The weakness class is CWE-89 (improper neutralization of special elements used in an SQL command). The record calls the flaw unspecified and says that, under specific circumstances, it may also lead to code execution on the core server.
The fixed release is 2022 SU 5 in the sense that the record says the issue affects releases prior to it. We could not load Ivanti's advisory (SA-2023-12-19) when we tried, so confirm the fixed version and any extra steps there. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Find the version your Endpoint Manager core server runs. In the console, the About dialog under the Help menu should show the version and service update level. Compare it against 2022 SU 5.
Then check who can reach the core server. The record says the attacker needs access to the internal network, so the question is which networks and which machines can talk to it. Management servers in a flat network are the most exposed.
Review the core server and database logs for unexpected queries or errors from hosts that are not your managed clients, if you keep such logs.
What to do now
- Inventory every Endpoint Manager core server, including test and disaster recovery copies, and record the version and service update level.
- Read Ivanti advisory SA-2023-12-19 and install 2022 SU 5 or later after testing. Check whether your version of Endpoint Manager needs a different update path.
- Restrict network access to the core server and its database so that only managed clients and administrators can reach it.
- Review the logs on the core server for unusual database activity, and treat any unexplained activity as an incident.
- Plan to keep service updates current, since this class of bug is easier to miss in internal tools.
Why it matters
SQL injection happens when text from a request becomes part of a database query without being neutralized. The attacker can then change the query. Here the record says no authentication is needed, so the barrier is network access to the service. The record says retrieved output is possible, so data can leave the database too.
Endpoint management servers are high value. They hold an inventory of devices and have the power to push software to them. A bug that can reach code execution on the core server is worth taking seriously even when it needs an internal network position, because attackers who land on one workstation often have exactly that. Update, and tighten who can reach the server.
Try it yourself
A fix that ships months after the disclosure only helps if you know where it still needs applying. This demo shows how continuous monitoring keeps that picture current.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The record says no authentication is needed, but the attacker must have access to the internal network.
Can this lead to code execution?
The record says that under specific circumstances it may lead to remote code execution on the core server. It does not say what the circumstances are.
Sources
- Ivanti advisory SA-2023-12-19 (listed in the record; the page did not load for us, so this post relies on the NVD description)
- Safeguard Gold entry for CVE-2023-39336
Last reviewed: 19 October 2026.
