{"id":"CVE-2024-29847","title":"Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.","summary":"Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Ivanti","product":"EPM","affected":["EPM >= 2024 September Security Update < 2024 September Security Update","EPM >= 2022 SU6 < 2022 SU6"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2024-09-17T03:55:13.171392Z"},"exploitAvailable":true,"published":"2024-09-12","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:56:22.412Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-29847","references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022"}],"tags":["cve.org","exploit-available"],"epss":0.52082,"epssPercentile":0.9896,"exploits":{"github":1,"githubRepos":["https://github.com/sinsinology/CVE-2024-29847"],"checkedAt":"2026-11-05T20:33:42.475Z"},"ingestedAt":"2026-11-05T20:33:06.637Z","slug":"CVE-2024-29847","body":"## Overview\n\nDeserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.\n\n## Affected\n\n- `EPM >= 2024 September Security Update < 2024 September Security Update`\n- `EPM >= 2022 SU6 < 2022 SU6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":77,"depthScoreParts":{"impact":55,"likelihood":10.4,"exploitation":12,"ransomware":0},"changes":[]}