Endpoint Manager and CSA
CVE-2021-44529: Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Published
ExploitedYes, in CISA KEVAdded 25 Mar 2024
Ransomware useKnownPer CISA
SeverityCRITICALCVSS 3.1 9.8
EPSS99%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Ivanti EPM 4.6 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Exploitation
CISA lists this CVE as exploited in the wild since 25 Mar 2024, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.