---
id: CVE-2024-29847
title: >-
  Deserialization of untrusted data in the agent portal of Ivanti EPM before
  2022 SU6, or the 2024 September update allows a remote unauthenticated
  attacker to achieve remote code execution.
summary: >-
  Deserialization of untrusted data in the agent portal of Ivanti EPM before
  2022 SU6, or the 2024 September update allows a remote unauthenticated
  attacker to achieve remote code execution.
severity: critical
cvss: 10
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Ivanti
product: EPM
affected:
  - EPM >= 2024 September Security Update < 2024 September Security Update
  - EPM >= 2022 SU6 < 2022 SU6
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-09-17T03:55:13.171392Z'
exploitAvailable: true
published: '2024-09-12'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:56:22.412Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-29847'
references:
  - url: >-
      https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
tags:
  - cve.org
  - exploit-available
epss: 0.52082
epssPercentile: 0.9896
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/sinsinology/CVE-2024-29847'
  checkedAt: '2026-11-05T20:33:42.475Z'
ingestedAt: '2026-11-05T20:33:06.637Z'
---

## Overview

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

## Affected

- `EPM >= 2024 September Security Update < 2024 September Security Update`
- `EPM >= 2022 SU6 < 2022 SU6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.