The nature of the vulnerability meant that attackers with access to a target’s internal network could exploit it through low-complexity attacks, requiring neither privileges nor user interaction. Ivanti highlighted the potential risk, stating, “If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication. This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server.”

While Ivanti assures its customers that there is no evidence of attackers exploiting this vulnerability against its user base, the company has taken proactive measures. Public access to an advisory containing full details about CVE-2023-39336 has been temporarily blocked. This strategic move provides Ivanti’s customers with additional time to secure their devices before threat actors can potentially exploit the vulnerability using the disclosed information.