Description Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM allows authenticated attackers to escalate privileges to administrative levels.

Executive Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM enables authenticated attackers to gain administrative access, posing a critical threat to organizational security.

Vulnerability Details

CVE-ID: CVE-2026-9614

Affected Software: Ivanti Neurons for ITSM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an access control flaw that allows a remote, authenticated attacker to bypass standard permissions and gain administrative control over the ITSM platform.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. An attacker gaining administrative access to an ITSM platform can compromise sensitive organizational data, modify system configurations, and potentially pivot into other internal systems, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Ivanti for the Neurons for ITSM platform immediately.

Proactive Monitoring: Review administrative audit logs for unauthorized user activity or suspicious privilege elevation events.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts and restrict access to the management console to trusted internal IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete platform compromise, organizations using Ivanti Neurons for ITSM must prioritize this update. Ensure that all patches are tested and deployed rapidly to mitigate the risk of unauthorized administrative access.

Description Summary:
A SQL injection vulnerability in the Ivanti Endpoint Manager web console allows remote authenticated attackers to achieve remote code execution.

Executive Summary:
A critical SQL injection vulnerability in the Ivanti Endpoint Manager web console allows authenticated attackers to gain remote code execution, posing a significant risk to enterprise environments.

Vulnerability Details

CVE-ID: CVE-2026-8111

Affected Software: Ivanti Endpoint Manager

Affected Versions: All versions prior to 2024 SU6

Vulnerability: The application fails to properly neutralize special elements used in SQL commands (CWE-89), leading to SQL injection. The vulnerability requires the attacker to be authenticated (PR:L), but once exploited, it allows for remote code execution on the server.

Business Impact

The ability to execute arbitrary code via the Endpoint Manager console provides an attacker with complete control over the management platform. With a CVSS score of 8.8, this vulnerability could be used to deploy malware, exfiltrate sensitive endpoint data, or move laterally within the network.

Remediation Plan

Immediate Action: Upgrade Ivanti Endpoint Manager to version 2024 SU6 or later immediately.

Proactive Monitoring: Review web console logs for suspicious SQL syntax or unusual query behavior that may indicate an ongoing exploitation attempt.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rulesets configured to detect and block common SQL injection patterns targeting administrative web consoles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection in management software is a high-value target for attackers, making rapid patching essential.

Analyst Recommendation

Ivanti Endpoint Manager is a critical infrastructure component; therefore, any vulnerability allowing remote code execution must be addressed with the highest priority. Administrators should proceed with the update to 2024 SU6 immediately to secure the environment.

Description Summary:
Ivanti Xtraction allows remote authenticated attackers to read sensitive files and write arbitrary HTML files, leading to information disclosure and potential client-side attacks.

Executive Summary:
A critical file management vulnerability in Ivanti Xtraction allows remote attackers to read sensitive files and perform arbitrary file writes, risking full system information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-8043

Affected Software: Ivanti Xtraction

Affected Versions: < 2026.2

Vulnerability: The vulnerability stems from external control of a file name or path (CWE-73), allowing a remote authenticated attacker to manipulate file operations. This can be weaponized to read sensitive system files or inject malicious HTML into the web directory.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk of information disclosure and potential site-wide client-side attacks. Unauthorized access to system files could lead to the exposure of credentials, configuration data, or further compromise of the web server.

Remediation Plan

Immediate Action: Upgrade Ivanti Xtraction to version 2026.2 or later to address the insecure file path handling.

Proactive Monitoring: Monitor web server logs for requests targeting sensitive system paths and unexpected file creation events in the web directory.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing path traversal sequences or attempts to write files to restricted web directories.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the security of the Xtraction environment. Administrators must perform the update to version 2026.2 without delay and conduct a thorough review of file integrity on the host system.

Description Summary:
An improper input validation vulnerability in Ivanti EPMM allows an authenticated administrator to execute arbitrary code on the system.

Executive Summary:
A critical input validation vulnerability in Ivanti Endpoint Manager Mobile is currently under active exploitation and requires immediate administrative action to prevent remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6973

Affected Software: Ivanti Endpoint Manager Mobile (EPMM)

Affected Versions: Ivanti Endpoint Manager Mobile (EPMM) before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1

Vulnerability: This vulnerability involves improper input validation (CWE-20) that can be leveraged by a remotely authenticated user with administrative privileges to achieve remote code execution.

Business Impact

The ability for an administrative user to execute remote code on the EPMM appliance presents a significant threat to organizational mobile device management security. An attacker who gains these privileges could manage, track, or compromise all enrolled mobile devices, leading to widespread corporate data theft and surveillance. With a CVSS score of 9.5, the risk to the confidentiality and integrity of the mobile fleet is extreme.

Remediation Plan

Immediate Action: Upgrade Ivanti Endpoint Manager Mobile to version 12.6.1.1, 12.7.0.1, or 12.8.0.1 as specified by the vendor advisory.

Proactive Monitoring: Monitor administrative access logs for unusual activity or unauthorized configuration changes that could indicate an attacker is attempting to leverage this vulnerability.

Compensating Controls: Restrict administrative console access to trusted IP addresses and implement multi-factor authentication for all administrative accounts to mitigate the potential for credential misuse.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in our curated data sources at this time.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of May 6, 2026. While the vulnerability requires administrative authentication, the potential for total system impact necessitates urgent remediation.

Analyst Recommendation

Due to the confirmed active exploitation of this flaw, administrators must prioritize the update to the fixed versions. Ensure that all administrative access to the EPMM interface is strictly controlled and audited to prevent further exploitation of this vulnerability.

Description Summary:
An improper certificate validation vulnerability in Ivanti EPMM allows remote unauthenticated attackers to impersonate Sentry hosts and obtain valid client certificates.

Executive Summary:
An improper certificate validation flaw in Ivanti Endpoint Manager Mobile (EPMM) allows remote unauthenticated attackers to impersonate registered Sentry hosts, posing a severe risk to organizational infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-5787

Affected Software: Ivanti Endpoint Manager Mobile

Affected Versions: Versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1

Vulnerability: This is an improper certificate validation issue categorized as CWE-295. A remote unauthenticated attacker can exploit this flaw over the network with high complexity and no user interaction required.

Business Impact

A successful exploit could allow malicious actors to obtain valid CA-signed client certificates and impersonate registered Sentry hosts, leading to unauthorized access to sensitive internal communications and enterprise resources. While the CVSS score is 8.9, placing it in the high severity range, the potential for total technical impact and compromise of trust boundaries elevates the organizational risk.

Remediation Plan

Immediate Action: Update Ivanti Endpoint Manager Mobile (EPMM) to version 12.8.0.1, 12.7.0.1, 12.6.1.1, or later as specified in the vendor advisory.

Proactive Monitoring: Monitor network and access logs for anomalous registration attempts or suspicious certificate requests originating from unverified Sentry hosts.

Compensating Controls: Implement strict network segmentation around EPMM deployment environments and enforce strict monitoring on certificate authority issuance pipelines.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA SSVC assessment indicates that exploitation is currently none, though the inherent risk remains significant.

Analyst Recommendation

Given the high severity and the potential for severe operational disruption through identity spoofing, administrators must treat this advisory with urgency. Apply the appropriate vendor security updates immediately to mitigate the risk of unauthorized certificate issuance and host impersonation.

Description Summary:
An improper access control vulnerability in Ivanti EPMM allows a remote authenticated attacker to gain administrative access.

Executive Summary:
An improper access control vulnerability in Ivanti Endpoint Manager Mobile allows remote authenticated attackers to achieve total system compromise, posing a severe threat to enterprise infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-5786

Affected Software: Ivanti Endpoint Manager Mobile

Affected Versions: Versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1

Vulnerability: This is an improper access control vulnerability, classified under CWE-284, affecting Ivanti Endpoint Manager Mobile. The flaw allows a remote attacker with low-level authenticated privileges and no user interaction to escalate privileges and gain full administrative access.

Business Impact

A successful exploitation of this vulnerability can lead to complete confidentiality, integrity, and availability loss across the affected endpoint management infrastructure. Attackers who gain administrative access can manipulate managed devices, deploy malicious configurations, or exfiltrate sensitive enterprise data. The high CVSS score of 8.8 reflects the catastrophic impact of administrative takeover, justifying immediate and prioritized remediation.

Remediation Plan

Immediate Action: Update Ivanti Endpoint Manager Mobile to version 12.6.1.1, 12.7.0.1, 12.8.0.1, or later versions where the access control flaw is resolved.

Proactive Monitoring: Review administrative audit logs regularly for unexpected privilege escalation events, unauthorized administrative actions, or anomalous login patterns from low-privileged accounts.

Compensating Controls: Restrict network access to the EPMM administration interfaces to trusted management subnets and enforce multi-factor authentication for all user sessions to minimize unauthorized access risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA's SSVC assessment confirms that exploitation is currently none, but the remote attack vector and total technical impact warrant strong vigilance.

Analyst Recommendation

This vulnerability represents a critical risk to organizational asset management due to the potential for complete administrative takeover by authenticated attackers. Security teams must prioritize applying the vendor security updates immediately to eliminate the underlying access control flaw and secure the environment.

Description Summary:
Ivanti DSM contains an exposed dangerous method that allows a local authenticated attacker to elevate their privileges to a higher level.

Executive Summary:
A vulnerability in Ivanti Desktop and Server Management (DSM) allows a local authenticated attacker to achieve privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-3483

Affected Software: Ivanti Desktop and Server Management (DSM)

Affected Versions: Versions prior to 2026.1.1

Vulnerability: The flaw is categorized as an exposed dangerous method (CWE-749), which allows an attacker who already possesses local authenticated access to execute unauthorized actions and escalate privileges on the host system.

Business Impact

Successful exploitation of this vulnerability grants an attacker elevated permissions, which could lead to a full system compromise, unauthorized data access, and the potential for lateral movement within the network. With a CVSS score of 7.8, this vulnerability is classified as High severity, indicating that the impact on confidentiality, integrity, and availability is substantial.

Remediation Plan

Immediate Action: Update all instances of Ivanti Desktop and Server Management to version 2026.1.1 or later to resolve the underlying method exposure.

Proactive Monitoring: Audit local system logs for unusual account activity or unexpected privilege changes that may indicate an attempt to leverage this local escalation vector.

Compensating Controls: Restrict local access to the server to only authorized personnel and implement the principle of least privilege to minimize the potential impact should an account be compromised.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local authenticated access, which inherently limits the attack surface to individuals who have already gained a foothold on the system.

Analyst Recommendation

Given the High severity of this privilege escalation flaw, administrators should prioritize patching their Ivanti DSM environments. Ensuring that software is updated to version 2026.1.1 is the only definitive way to eliminate the risk posed by this exposed dangerous method.

Description Summary:
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

Executive Summary:
This critical authentication bypass vulnerability in Ivanti Endpoint Manager is actively exploited in the wild and enables unauthenticated attackers to exfiltrate sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-1603

Affected Software: Ivanti Endpoint Manager (EPM)

Affected Versions: Ivanti Endpoint Manager before version 2024 SU5

Vulnerability: The flaw is an authentication bypass (CWE-288) that allows remote, unauthenticated attackers to access and leak stored credential data from the system. The vulnerability stems from an alternate path or channel that circumvents established authentication mechanisms.

Business Impact

The severity of this vulnerability is rated as critical with a CVSS score of 9.5, reflecting the high potential for unauthorized data access. Because Ivanti EPM typically manages enterprise-wide assets with elevated privileges, the exposure of stored credentials presents a severe risk of lateral movement, privilege escalation, and total system compromise. Successful exploitation could lead to widespread unauthorized access across the target network, causing significant operational and security repercussions.

Remediation Plan

Immediate Action: Update all instances of Ivanti Endpoint Manager to version 2024 SU5 or later immediately.

Proactive Monitoring: Review access logs for unusual, unauthorized API calls or unexpected authentication attempts targeting credential storage endpoints.

Compensating Controls: Implement strict network segmentation and restrict access to the EPM management interface to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: Yes, a Nuclei detection template exists.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of March 9, 2026. Given that the flaw allows unauthenticated credential exfiltration, the barrier to entry for attackers is extremely low, making immediate remediation essential to prevent unauthorized access.

Analyst Recommendation

Due to the critical severity and confirmed active exploitation, this vulnerability poses an immediate threat to your infrastructure. Organizations must prioritize patching to version 2024 SU5 without delay. If immediate patching is not possible, ensure that the EPM management interface is isolated from public-facing networks to mitigate the risk of remote exploitation.

Description Summary:
Ivanti Endpoint Manager Mobile contains a code injection vulnerability that permits unauthenticated remote code execution.

Executive Summary:
Ivanti Endpoint Manager Mobile is vulnerable to an unauthenticated remote code injection flaw that is currently being exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-1340

Affected Software: Ivanti Endpoint Manager Mobile (EPMM)

Affected Versions: See vendor advisory

Vulnerability: This is a code injection vulnerability (CWE-94) that allows unauthenticated attackers to execute arbitrary code on the target system. The flaw exists within the core functionality of the management platform and does not require prior authentication to trigger.

Business Impact

The ability for an unauthenticated attacker to achieve remote code execution poses a catastrophic risk to organizational security. This vulnerability could lead to total system compromise, unauthorized access to managed mobile device data, and the potential for lateral movement across the internal network. Given the high CVSS score of 9.5 and confirmed active exploitation, the risk of data breach and operational downtime is extreme.

Remediation Plan

Immediate Action: Apply the vendor provided patches or security updates immediately as outlined in the official Ivanti security advisory.

Proactive Monitoring: Monitor system logs for unauthorized processes, unusual outbound network traffic from the EPMM server, or unexpected service execution patterns.

Compensating Controls: Deploy Web Application Firewall rules to detect and block malicious injection attempts, and ensure the EPMM interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module is available.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of April 7, 2026. The availability of weaponized exploit code significantly lowers the barrier to entry for attackers, making immediate patching a critical priority for all affected environments.

Analyst Recommendation

The extreme severity of this vulnerability, combined with confirmed active exploitation, necessitates immediate action. Organizations must prioritize the installation of vendor patches to prevent potential compromise. If patching is not immediately feasible, restrict network access to the affected interface to mitigate the risk of unauthenticated exploitation.

Description Summary:
A code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows unauthenticated remote attackers to execute arbitrary code via crafted HTTP requests.

Executive Summary:
This critical code injection vulnerability in Ivanti Endpoint Manager Mobile is currently being exploited in the wild and enables unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-1281

Affected Software: Ivanti Endpoint Manager Mobile (EPMM)

Affected Versions: 12.5.0.0 and prior, 12.5.1.0 and prior, 12.6.0.0 and prior, 12.6.1.0 and prior, and 12.7.0.0 and prior.

Vulnerability: This is a code injection flaw (CWE-94) that allows unauthenticated remote attackers to achieve remote code execution by sending specially crafted HTTP requests to the target system. The vulnerability does not require any user interaction or authentication to trigger.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows full system compromise without any authentication. Successful exploitation grants attackers total control over the affected EPMM instance, potentially leading to the theft of sensitive mobile device data, credential harvesting, or the lateral movement of threats into the internal corporate network. The active exploitation status significantly increases the operational risk to any organization running vulnerable versions of this software.

Remediation Plan

Immediate Action: Apply the appropriate RPM update (12.x.0.x or 12.x.1.x) immediately as provided by the vendor; a permanent fix is integrated into release version 12.8.0.0.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests, particularly those containing suspicious code patterns or unexpected headers, and monitor for unauthorized process execution on the EPMM appliance.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to filter or block malicious HTTP requests targeting the vulnerable endpoints until patching is complete.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module exists and multiple public proof-of-concept repositories are available on GitHub.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of January 29, 2026. Given the availability of weaponized exploit code and the critical nature of the flaw, the risk of compromise is extremely high.

Analyst Recommendation

Due to the confirmed active exploitation and the critical severity of this vulnerability, organizations must treat this as a top-priority security event. Administrators should apply the vendor-provided RPM updates immediately to eliminate the remote code execution vector. If patching cannot occur instantly, ensure the appliance is isolated from the public internet until the necessary updates are deployed to prevent unauthorized access.

Description Summary:
An authentication bypass vulnerability in Ivanti Sentry allows unauthenticated attackers to create arbitrary administrative accounts and gain full access.

Executive Summary:
An authentication bypass in Ivanti Sentry enables unauthenticated attackers to create administrative accounts, granting them full control over the appliance.

Vulnerability Details

CVE-ID: CVE-2026-10523

Affected Software: Ivanti Sentry

Affected Versions: Before R10.5.2, R10.6.2, and R10.7.1

Vulnerability: This vulnerability (CWE-288) allows an unauthenticated remote attacker to bypass authentication mechanisms, create new administrative user accounts, and obtain full administrative privileges within the system.

Business Impact

The CVSS score of 9.9 underscores the severe business impact of this vulnerability. By bypassing authentication, attackers can gain complete control over the appliance, potentially leading to unauthorized data access, network disruption, and the ability to maintain persistence within the network. This is particularly dangerous when coupled with the command injection vulnerability (CVE-2026-10520).

Remediation Plan

Immediate Action: Update Ivanti Sentry to version R10.5.2, R10.6.2, R10.7.1, or higher to close the authentication bypass flaw.

Proactive Monitoring: Audit existing administrative accounts for unauthorized entries or unknown users created recently.

Compensating Controls: Limit access to the management interfaces of Ivanti Sentry to trusted management subnets and verify integrity of administrative logs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total failure of access controls. It is imperative that administrators apply the provided updates immediately to prevent unauthorized administrative takeover of the appliance. Failure to do so leaves the organization highly vulnerable to persistent, high-level unauthorized access.

Description Summary:
A critical OS command injection vulnerability in Ivanti Sentry allows remote unauthenticated users to achieve root-level remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in Ivanti Sentry allows attackers to gain root-level access, presenting an extreme risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-10520

Affected Software: Ivanti Sentry

Affected Versions: Before R10.5.2, R10.6.2, and R10.7.1

Vulnerability: This OS command injection vulnerability allows an unauthenticated attacker to send a crafted POST request to the handleMessage endpoint, leading to full root-level remote code execution.

Business Impact

With a perfect CVSS score of 10.0, this is a critical vulnerability. As Ivanti Sentry often resides at the network edge to manage mobile and enterprise traffic, a root-level compromise provides attackers with a strategic foothold to move laterally into internal systems, intercept traffic, and exfiltrate sensitive enterprise data.

Remediation Plan

Immediate Action: Upgrade to Ivanti Sentry versions R10.5.2, R10.6.2, R10.7.1, or higher immediately.

Proactive Monitoring: Review logs for unusual POST requests to the handleMessage endpoint and monitor for unexpected administrative account activity or unauthorized system processes.

Compensating Controls: Restrict external access to the Sentry management interface using firewall rules until the patch is deployed, and monitor for unauthorized inbound traffic.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 9, 2026, there is no evidence of this specific vulnerability being exploited in the wild, though a public exploit is available. The high severity and ease of exploitation necessitate immediate action.

Analyst Recommendation

This vulnerability is highly critical and provides attackers with full system control. Organizations must prioritize the patch deployment process and ensure that any Ivanti Sentry device exposed to the internet is updated without delay.

Description Summary:
Ivanti Endpoint Manager is vulnerable to remote code execution due to insufficient filename validation, allowing unauthenticated attackers to upload malicious files.

Executive Summary:
A critical vulnerability in Ivanti Endpoint Manager allows remote unauthenticated attackers to achieve remote code execution through insufficient filename validation.

Vulnerability Details

CVE-ID: CVE-2025-9872

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions prior to 2024 SU3 SR1 and 2022 SU8 SR2

Vulnerability: This vulnerability is a result of CWE-434, which is the unrestricted upload of a file with a dangerous type. An unauthenticated attacker can leverage this flaw to execute arbitrary code on the target system, though the attack requires user interaction.

Business Impact

The ability for an unauthenticated attacker to achieve remote code execution poses a severe risk to organizational infrastructure, as it grants full control over the compromised server. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to complete data compromise, lateral movement within the network, and significant operational disruption.

Remediation Plan

Immediate Action: Upgrade to Ivanti Endpoint Manager 2024 SU3 SR1 or 2022 SU8 SR2 immediately to apply the necessary filename validation patches.

Proactive Monitoring: Review web server and application logs for anomalous file upload attempts or unexpected executable files appearing in temporary directories.

Compensating Controls: Implement strict file type filtering and validation at the Web Application Firewall (WAF) level to prevent the upload of unauthorized file extensions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit is positive, the potential for remote code execution makes this a high-priority item for patching.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be treated with high urgency. Administrators must prioritize the deployment of the vendor-provided updates across all instances of Ivanti Endpoint Manager to neutralize the risk of unauthorized system access.

Description Summary:
A path traversal vulnerability in Ivanti Endpoint Manager allows remote unauthenticated attackers to achieve remote code execution, provided that user interaction occurs.

Executive Summary:
Ivanti Endpoint Manager contains a critical path traversal vulnerability that could allow an unauthenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-9713

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions before 2024 SU4

Vulnerability: This flaw is a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to execute arbitrary code. Successful exploitation requires user interaction.

Business Impact

The ability for an unauthenticated attacker to achieve remote code execution represents a severe threat to organizational security. With a CVSS score of 8.8, this vulnerability permits full compromise of the affected server, potentially leading to unauthorized data exfiltration, lateral movement within the network, and complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade all instances of Ivanti Endpoint Manager to version 2024 SU4 or later to resolve the underlying path traversal flaw.

Proactive Monitoring: Review system access logs for unusual file path requests or signs of unauthorized command execution. Monitor network traffic for unexpected inbound connections targeting the management interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious path traversal patterns. Restrict access to the management console to known, trusted IP addresses to minimize the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 14, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly severe, the requirement for user interaction provides a slight barrier to exploitation.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a significant risk to the infrastructure managed by Ivanti Endpoint Manager. Administrators should prioritize the deployment of the 2024 SU4 update immediately. Organizations unable to patch should verify that the management interface is not exposed to the public internet and implement robust access controls to prevent unauthorized interaction.

Description Summary:
Insufficient filename validation in Ivanti Endpoint Manager allows an unauthenticated remote attacker to achieve remote code execution via file upload.

Executive Summary:
An unauthenticated remote code execution vulnerability in Ivanti Endpoint Manager poses a severe threat to internal infrastructure and requires immediate patching.

Vulnerability Details

CVE-ID: CVE-2025-9712

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions prior to 2024 SU3 SR1 and 2022 SU8 SR2

Vulnerability: This vulnerability involves improper filename validation, categorized as CWE-434, which allows an unauthenticated attacker to upload dangerous files to the system. While user interaction is required, successful exploitation grants the attacker remote code execution capabilities.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on an Endpoint Manager server constitutes a critical security breach. This could lead to full system compromise, unauthorized access to sensitive internal data, and the potential for lateral movement across the enterprise network. With a CVSS score of 8.8, this vulnerability is classified as High severity and necessitates urgent remediation to prevent total system compromise.

Remediation Plan

Immediate Action: Organizations must immediately upgrade their Ivanti Endpoint Manager instances to the fixed versions, specifically 2024 SU3 SR1 or 2022 SU8 SR2, as specified by the vendor.

Proactive Monitoring: Security teams should monitor server access logs for unusual file upload activity or unexpected execution of processes originating from the management interface.

Compensating Controls: Deploy Web Application Firewall rules to inspect and block suspicious file upload requests or anomalous traffic patterns directed toward the Endpoint Manager web interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for unauthenticated remote code execution, making it a high-priority target for threat actors despite the requirement for user interaction.

Analyst Recommendation

Given the high CVSS score and the critical nature of remote code execution, it is imperative that administrators prioritize the application of the vendor-provided security patches. Delaying these updates leaves the management infrastructure exposed to potential exploitation. Ensure that all affected systems are identified and updated immediately to maintain the integrity and security of the network.

Description Summary:
Ivanti Endpoint Manager contains an improper encryption flaw that allows a local authenticated attacker to decrypt sensitive user passwords.

Executive Summary:
A critical vulnerability in Ivanti Endpoint Manager permits local authenticated attackers to decrypt sensitive user credentials, posing a severe risk to internal account security.

Vulnerability Details

CVE-ID: CVE-2025-6996

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions before 2024 SU3 and 2022 SU8 Security Update 1

Vulnerability: The software suffers from improper storage of passwords in a recoverable format (CWE-257). A local authenticated attacker can leverage this flaw to decrypt passwords belonging to other system users.

Business Impact

The ability for an attacker to decrypt other users' passwords constitutes a total loss of confidentiality for credentials stored within the agent. Given the CVSS score of 8.4, this vulnerability represents a high risk, as it facilitates lateral movement and privilege escalation within the environment. Unauthorized access to these credentials could lead to widespread system compromise and significant operational disruption.

Remediation Plan

Immediate Action: Update Ivanti Endpoint Manager to version 2024 SU3, 2022 SU8 Security Update 1, or a later supported release to resolve the encryption vulnerability.

Proactive Monitoring: Review system access logs for unauthorized attempts to access or modify agent configuration files or associated credential stores.

Compensating Controls: Restrict local system access to authorized personnel only and enforce the principle of least privilege for all local accounts to limit the potential scope of an authenticated attack.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of credential exposure, but it requires prior local authentication to execute.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of user credentials within the Ivanti environment. IT administrators should prioritize the deployment of the security updates provided by Ivanti to ensure that password storage mechanisms are properly secured. Immediate patching is essential to prevent potential credential theft and subsequent unauthorized access to sensitive systems.

Description Summary:
Ivanti Endpoint Manager contains a vulnerability involving improper encryption that allows a local authenticated attacker to decrypt user passwords.

Executive Summary:
Ivanti Endpoint Manager contains a flaw in its agent encryption that permits local authenticated attackers to decrypt sensitive user credentials, posing a significant risk to organizational identity security.

Vulnerability Details

CVE-ID: CVE-2025-6995

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions before 2024 SU3 and 2022 SU8 Security Update 1

Vulnerability: This vulnerability is caused by the storage of passwords in a recoverable format, identified as CWE-257. An attacker with local authenticated access to the agent can exploit this flaw to perform unauthorized decryption of credentials belonging to other users.

Business Impact

The ability for a local user to decrypt the passwords of other users within the Ivanti Endpoint Manager environment constitutes a high-severity risk. Given the CVSS score of 8.4, this vulnerability could lead to widespread credential theft, unauthorized lateral movement, and complete compromise of user accounts managed by the platform.

Remediation Plan

Immediate Action: Update Ivanti Endpoint Manager to version 2024 SU3, 2022 SU8 Security Update 1, or a later version to remediate the encryption flaw.

Proactive Monitoring: Review local system logs for unusual authentication activity or evidence of unauthorized access to agent-related configuration files and directories.

Compensating Controls: Restrict local system access to authorized personnel only and enforce the principle of least privilege to minimize the number of users capable of interacting with the agent environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires local access, the nature of the flaw makes it highly effective for privilege escalation once a foothold on a managed endpoint is established.

Analyst Recommendation

This vulnerability represents a critical risk to the security of managed endpoints and the confidentiality of user credentials. Administrators should prioritize patching all instances of Ivanti Endpoint Manager to the specified fixed versions immediately to prevent potential exploitation by malicious local actors.

Description Summary:
A missing authorization vulnerability in multiple Ivanti products allows a remote authenticated attacker with read-only administrative privileges to modify restricted system settings.

Executive Summary:
A missing authorization flaw in multiple Ivanti products permits authenticated attackers with limited administrative rights to perform unauthorized configuration changes, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-55148

Affected Software: Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access

Affected Versions: Connect Secure <22.7R2.9 and 22.8R2; Policy Secure <22.7R1.6; ZTA Gateway <2.8R2.3-723; Neurons for Secure Access <22.8R1.4

Vulnerability: This vulnerability, classified as CWE-862, stems from a failure to properly validate authorization levels for administrative functions. It allows an attacker who already possesses read-only admin privileges to bypass restrictions and alter sensitive system configurations.

Business Impact

The ability for a read-only administrator to modify system settings threatens the overall security posture and operational integrity of the affected network infrastructure. With a CVSS score of 7.6, this vulnerability represents a high risk, as it could be leveraged to escalate privileges or prepare the environment for further exploitation. Successful compromise may lead to unauthorized access, potential service disruption, or the manipulation of security policies.

Remediation Plan

Immediate Action: Administrators must update their respective Ivanti software to the versions specified in the vendor security advisory to remediate this authorization flaw.

Proactive Monitoring: Review administrative audit logs for any unexpected configuration changes or modifications initiated by accounts with read-only permissions.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users with administrative access until patches can be applied, and ensure management interfaces are not exposed to the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation within the management plane of critical security appliances.

Analyst Recommendation

Given the critical nature of the affected products as security gateways and policy enforcement points, the potential for unauthorized configuration changes must be addressed immediately. Organizations should prioritize the deployment of the provided patches to ensure that read-only administrators cannot perform unauthorized actions, thereby maintaining the integrity of the security infrastructure.

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple Ivanti products, allowing an unauthenticated remote attacker to perform sensitive actions on behalf of an authenticated user.

Executive Summary:
A critical CSRF vulnerability in Ivanti security gateways permits unauthenticated remote attackers to execute unauthorized actions on behalf of authenticated users, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-55147

Affected Software: Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access

Affected Versions: Ivanti Connect Secure < 22.7R2.9/22.8R2; Ivanti Policy Secure < 22.7R1.6; Ivanti ZTA Gateway < 2.8R2.3-723; Ivanti Neurons for Secure Access < 22.8R1.4

Vulnerability: This vulnerability is a Cross-Site Request Forgery (CWE-352) that allows an unauthenticated attacker to manipulate a victim into executing unauthorized administrative or sensitive operations. While the attacker does not require prior authentication, the attack requires user interaction to succeed.

Business Impact

The exploitation of this vulnerability could lead to total loss of integrity and confidentiality, as attackers can perform sensitive actions within the context of an administrator or privileged user session. Given the CVSS score of 8.8, this flaw represents a high-risk entry point for unauthorized configuration changes or lateral movement. Failure to remediate may result in a complete compromise of the secure access environment, potentially impacting the entire corporate network.

Remediation Plan

Immediate Action: Update all affected Ivanti appliances to the specified fixed versions immediately, as defined in the vendor security advisory.

Proactive Monitoring: Review system and access logs for unusual administrative requests or unexpected configuration changes that do not correlate with known authorized activity.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter suspicious requests and ensure that CSRF tokens are strictly validated across all sessions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The requirement for user interaction slightly reduces the immediate risk compared to fully automated remote code execution flaws, but the high impact necessitates prompt patching.

Analyst Recommendation

Organizations utilizing the affected Ivanti products must prioritize the application of the vendor-supplied patches to eliminate this CSRF vector. Given the privileged nature of these gateways, ensuring that all software is updated to the latest secure versions is critical to maintaining network perimeter security and preventing unauthorized administrative control.

Description Summary:
A missing authorization vulnerability in multiple Ivanti products allows a remote authenticated attacker to hijack existing HTML5 connections.

Executive Summary:
A high-severity missing authorization flaw in multiple Ivanti products permits remote authenticated attackers to hijack active HTML5 sessions, potentially leading to full account compromise.

Vulnerability Details

CVE-ID: CVE-2025-55145

Affected Software: Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access

Affected Versions: Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723, and Ivanti Neurons for Secure Access before 22.8R1.4

Vulnerability: The vulnerability is classified as CWE-862, Missing Authorization. It occurs within the HTML5 connection handling mechanism, allowing an authenticated attacker to perform unauthorized actions by hijacking active sessions.

Business Impact

Successful exploitation poses a significant risk to organizational integrity, as session hijacking grants an attacker the same level of access as the victim. Given the CVSS score of 8.9, this vulnerability carries a high risk of unauthorized data access and potential lateral movement within the network. The ability to intercept and control active sessions undermines the security of remote access infrastructure, necessitating immediate attention.

Remediation Plan

Immediate Action: Update all affected Ivanti products to the versions specified in the vendor advisory: Connect Secure (22.7R2.9 or 22.8R2), Policy Secure (22.7R1.6), ZTA Gateway (2.8R2.3-723), and Neurons for Secure Access (22.8R1.4).

Proactive Monitoring: Review administrative and user access logs for suspicious session activity, particularly unexpected HTML5 connection behaviors or concurrent logins from unusual locations.

Compensating Controls: Implement strict network segmentation and ensure that multi-factor authentication is enforced for all remote access points to limit the impact of potential session hijacking.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires an authenticated attacker, the high severity of session hijacking within remote access gateways makes this a priority for patching.

Analyst Recommendation

This vulnerability represents a critical risk to the security of remote access infrastructure. Administrators must prioritize the deployment of the provided patches across all affected Ivanti environments immediately. Failure to address this flaw could allow attackers to bypass security controls by hijacking established sessions, leading to unauthorized access to sensitive internal resources.

Description Summary:
A missing authorization vulnerability in multiple Ivanti products allows authenticated attackers with read-only admin privileges to modify authentication settings.

Executive Summary:
A missing authorization vulnerability in Ivanti secure access products allows authenticated attackers with read-only privileges to perform unauthorized configuration changes, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2025-55142

Affected Software: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access.

Affected Versions: Ivanti Connect Secure (before 22.7R2.9 or 22.8R2), Ivanti Policy Secure (before 22.7R1.6), Ivanti ZTA Gateway (before 2.8R2.3-723), and Ivanti Neurons for Secure Access (before 22.8R1.4).

Vulnerability: The vulnerability is a missing authorization flaw (CWE-862) that permits a remote attacker who has already obtained read-only administrative privileges to improperly configure authentication-related settings, effectively escalating their control over the environment.

Business Impact

Successful exploitation of this flaw could allow an attacker with limited administrative access to modify authentication parameters, potentially leading to unauthorized access, account takeover, or the bypass of security controls. With a CVSS score of 8.8, this vulnerability is classified as High severity, as it facilitates the compromise of core identity and access management functions within the affected network infrastructure.

Remediation Plan

Immediate Action: Organizations must update the affected Ivanti software to the specified fixed versions: Connect Secure (22.7R2.9 or 22.8R2), Policy Secure (22.7R1.6), ZTA Gateway (2.8R2.3-723), and Neurons for Secure Access (22.8R1.4).

Proactive Monitoring: Security teams should audit administrative access logs for unusual configuration changes, particularly those involving authentication or identity provider settings, originating from read-only service accounts.

Compensating Controls: Restrict administrative interface access to known, trusted management IP addresses and implement multi-factor authentication for all administrative sessions to limit the utility of compromised read-only credentials.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires existing authenticated access, the ability to modify authentication settings provides an attacker with a powerful path to further compromise the network.

Analyst Recommendation

Given the potential for privilege escalation and the critical nature of the affected Ivanti gateway products, patching should be prioritized immediately. Organizations should verify their current versions against the vendor advisory and initiate the update process to prevent potential exploitation of their authentication infrastructure.

Description Summary:
A missing authorization flaw in multiple Ivanti secure access products allows a remote authenticated user with read-only admin privileges to modify critical authentication settings.

Executive Summary:
A missing authorization vulnerability in Ivanti secure access gateways permits authenticated attackers with restricted privileges to escalate their configuration control, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-55141

Affected Software: Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access

Affected Versions: Ivanti Connect Secure < 22.7R2.9/22.8R2; Ivanti Policy Secure < 22.7R1.6; Ivanti ZTA Gateway < 2.8R2.3-723; Ivanti Neurons for Secure Access < 22.8R1.4

Vulnerability: The vulnerability stems from a missing authorization check (CWE-862) within the administrative interface. It allows a remote attacker who already possesses read-only administrative credentials to unauthorizedly modify authentication-related configurations.

Business Impact

The ability for a read-only administrator to alter authentication settings represents a critical security failure, as it could facilitate account takeover, credential harvesting, or the bypassing of multi-factor authentication. With a CVSS score of 8.8, this flaw carries a high severity rating that could lead to full system compromise or lateral movement within the network. Organizations relying on these gateways for secure remote access face severe risks to their perimeter security posture if this vulnerability remains unpatched.

Remediation Plan

Immediate Action: Update the affected Ivanti software to the versions specified in the vendor advisory (e.g., Connect Secure 22.7R2.9 or 22.8R2) immediately.

Proactive Monitoring: Audit administrative access logs for unusual configuration changes, particularly those targeting authentication providers, MFA settings, or user identity stores.

Compensating Controls: Implement strict network segmentation for the management interface and enforce IP-based access control lists to restrict administrative access to known, trusted management workstations only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to subvert the primary security controls of the gateway appliance.

Analyst Recommendation

Given the high CVSS score and the nature of the privilege escalation, administrators must prioritize patching these gateways during the next maintenance window. Because this vulnerability allows an existing user to modify core security settings, it is imperative to also review current administrative user accounts for unauthorized activity that may have occurred prior to the patch application.

Description Summary:
Ivanti Endpoint Manager contains an improper cryptographic signature verification flaw in its patch management component, allowing remote unauthenticated attackers to execute arbitrary code.

Executive Summary:
A critical vulnerability in the Ivanti Endpoint Manager patch management component allows remote, unauthenticated attackers to execute arbitrary code on affected systems.

Vulnerability Details

CVE-ID: CVE-2025-13662

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions prior to 2024 SU4 SR1

Vulnerability: This vulnerability is an improper verification of cryptographic signatures (CWE-347) within the patch management component. An unauthenticated remote attacker can leverage this flaw to achieve arbitrary code execution, though successful exploitation requires user interaction.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code poses a severe risk to organizational infrastructure, as it grants full control over the compromised endpoint management server. Given the CVSS score of 7.8, this vulnerability represents a high-severity threat that could lead to widespread system compromise, data theft, and lateral movement within the network.

Remediation Plan

Immediate Action: Update all instances of Ivanti Endpoint Manager to version 2024 SU4 SR1 or later to resolve the cryptographic signature verification flaw.

Proactive Monitoring: Monitor system logs for unauthorized access attempts or unusual execution patterns originating from the patch management service.

Compensating Controls: Ensure that the management interface is not exposed to the public internet and restrict access to the management console to authorized internal network segments only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of authentication requirements makes this an attractive target, the requirement for user interaction provides a slight barrier to immediate exploitation.

Analyst Recommendation

The risk of remote code execution within a central management platform like Ivanti Endpoint Manager is unacceptable for any enterprise environment. Security teams should prioritize the deployment of the 2024 SU4 SR1 update immediately to secure the patch management component against potential exploitation.

Description Summary:
An improper control of dynamically managed code resources in Ivanti Endpoint Manager allows an unauthenticated attacker to perform arbitrary file writes, potentially resulting in remote code execution.

Executive Summary:
Ivanti Endpoint Manager is vulnerable to remote code execution due to an improper code resource management flaw that requires user interaction.

Vulnerability Details

CVE-ID: CVE-2025-13659

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions prior to 2024 SU4 SR1

Vulnerability: This vulnerability involves improper control of dynamically managed code resources (CWE-913). An unauthenticated, remote attacker can leverage this flaw to write arbitrary files to the server, which may lead to remote code execution, provided the attacker can facilitate the required user interaction.

Business Impact

The ability to perform arbitrary file writes on a core management server poses a severe risk to organizational infrastructure. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to full system compromise, data theft, and the deployment of malicious payloads across the managed environment.

Remediation Plan

Immediate Action: Upgrade all instances of Ivanti Endpoint Manager to version 2024 SU4 SR1 or later to apply the necessary security fixes.

Proactive Monitoring: Review server access logs for suspicious file write operations or unexpected modifications to configuration files and code directories.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect incoming traffic for patterns associated with unauthorized file system access or manipulation requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is remotely exploitable, the requirement for user interaction provides a slight barrier to automated exploitation.

Analyst Recommendation

Given the high CVSS score and the potential for total system compromise, this vulnerability should be prioritized for immediate remediation. Security teams must ensure that the update to 2024 SU4 SR1 is applied to all internet-facing instances of Ivanti Endpoint Manager to mitigate the risk of remote code execution.

Description Summary:
An insecure deserialization vulnerability in Ivanti Endpoint Manager allows a local authenticated attacker to escalate privileges to a higher level.

Executive Summary:
Ivanti Endpoint Manager contains an insecure deserialization flaw that permits a local authenticated attacker to achieve privilege escalation, posing a significant risk to internal system integrity.

Vulnerability Details

CVE-ID: CVE-2025-11622

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions before 2024 SU4

Vulnerability: This vulnerability is a deserialization of untrusted data (CWE-502) that occurs when the application improperly processes serialized objects. A local user who has already successfully authenticated to the system can leverage this flaw to gain elevated privileges.

Business Impact

The ability for a local user to escalate privileges represents a critical security failure, as it allows an attacker to bypass standard access controls and potentially gain full administrative control over the affected endpoint. Given the CVSS score of 7.8, this vulnerability poses a high risk to the confidentiality, integrity, and availability of managed systems. Successful exploitation could lead to unauthorized data access, lateral movement within the network, or the compromise of sensitive management functions.

Remediation Plan

Immediate Action: Update Ivanti Endpoint Manager to version 2024 SU4 or later to apply the necessary security fixes provided by the vendor.

Proactive Monitoring: Review system access logs for anomalous behavior or unexpected process executions originating from authenticated user accounts.

Compensating Controls: Ensure that local access to the management server is strictly restricted to authorized personnel only, utilizing the principle of least privilege to minimize the potential impact of local account compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 14, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already possess a local authenticated account, which acts as a barrier to entry but does not diminish the severity once an attacker has gained a foothold.

Analyst Recommendation

Organizations utilizing Ivanti Endpoint Manager must prioritize upgrading to version 2024 SU4 to address this privilege escalation risk. While local authentication is required, the potential for total system compromise necessitates prompt remediation to prevent internal threats from escalating their access levels and causing widespread damage.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager allows remote unauthenticated attackers to execute arbitrary JavaScript in an administrator session via user interaction.

Executive Summary:
Ivanti Endpoint Manager is affected by a critical stored cross-site scripting vulnerability that allows remote attackers to compromise administrator sessions.

Vulnerability Details

CVE-ID: CVE-2025-10573

Affected Software: Ivanti Endpoint Manager

Affected Versions: Versions prior to 2024 SU4 SR1

Vulnerability: This vulnerability, categorized as CWE-79, involves improper neutralization of input during web page generation. An unauthenticated remote attacker can store malicious JavaScript that executes within the browser context of an administrator, provided the administrator interacts with the compromised component.

Business Impact

The ability to execute arbitrary JavaScript in an administrator session poses a severe risk to organizational security. Successful exploitation could lead to full administrative account takeover, unauthorized modification of endpoint configurations, or the exfiltration of sensitive management data. With a CVSS score of 9.6, this vulnerability represents a critical threat to the integrity and confidentiality of the entire managed environment.

Remediation Plan

Immediate Action: Upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later as specified in the official vendor advisory.

Proactive Monitoring: Review web server and application access logs for suspicious input patterns or unusual script-like payloads directed at administrative consoles.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block cross-site scripting attempts targeting the Ivanti management interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 9, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation requires user interaction, the potential for total system impact makes this a high-priority risk.

Analyst Recommendation

Given the critical CVSS severity and the potential for full administrative compromise, organizations must prioritize patching Ivanti Endpoint Manager to version 2024 SU4 SR1. Immediate application of this update is necessary to prevent unauthorized access to your managed infrastructure and to secure administrative sessions against potential script injection attacks.

Description Summary:
An authentication bypass vulnerability in the Ivanti vTM admin panel allows remote unauthenticated attackers to gain unauthorized administrative access.

Executive Summary:
Ivanti vTM is affected by a critical authentication bypass vulnerability that is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2024-7593

Affected Software: Ivanti vTM

Affected Versions: All versions other than 22.2R1 or 22.7R2

Vulnerability: This vulnerability stems from an incorrect implementation of the authentication algorithm within the admin panel, enabling remote unauthenticated attackers to bypass security controls entirely.

Business Impact

Successful exploitation grants an attacker full administrative control over the Ivanti vTM appliance. Given the CVSS score of 9.8 and confirmed active exploitation, the risk of total system compromise, data exfiltration, and lateral movement within the network is extreme. Failure to remediate immediately could lead to a catastrophic security breach.

Remediation Plan

Immediate Action: Upgrade to version 22.2R1 or 22.7R2 immediately as per vendor instructions.

Proactive Monitoring: Review administrative access logs for unusual login patterns or unauthorized source IPs accessing the management interface.

Compensating Controls: Restrict access to the vTM management interface to trusted management networks or VPNs only, and implement strict egress filtering.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Aug 13, 2024, this vulnerability is confirmed to be under active exploitation in the wild. Organizations must prioritize this patch above all other non-critical maintenance tasks.

Analyst Recommendation

The severity of this vulnerability, combined with confirmed active exploitation, necessitates immediate action. Administrators must verify their versioning and apply the provided security patches without delay to prevent unauthorized administrative access to critical infrastructure.