VULNERABILITY INTELLIGENCE

CVE-2024-37397

CVSS score8.2 HIGH

EPSS probability59.26%

CISA KEVNot currently listed

Published2024-09-12

Last modified2026-06-17

Description

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.