SQL Injection in Ivanti CSA Admin Web Console

Successful exploitation allows an authenticated administrator-level attacker to run arbitrary SQL statements in the CSA backend context. This can enable unauthorized reading, modification, or deletion of database contents, manipulation of application state, and potential compromise of sensitive administrative or operational data stored by the product. Depending on database permissions and deployment specifics, the attacker may be able to cause significant integrity loss and service disruption.

If immediate patching is not possible, reduce exposure of the CSA administrative web console to only trusted management networks, strictly limit and review administrator access, and monitor administrative activity and database interactions for anomalous behavior. Because exploitation requires authenticated administrator access, enforcing strong access controls and minimizing the number of privileged accounts can reduce risk until the product is upgraded. These measures are compensating controls and do not replace vendor remediation.

Upgrade Ivanti Cloud Services Application to version 5.0.3 or later, as Ivanti fixed this vulnerability in CSA 5.0.3. Organizations should prioritize updating all affected CSA instances running version 5.0.2 or earlier to the latest supported release.