PT-2025-50085 · Ivanti · Ivanti Endpoint Manager

Published

2025-12-08

·

Updated

2026-01-13

·

CVE-2025-10573

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions 2024 SU4 and below
Description Ivanti Endpoint Manager contains a critical stored cross-site scripting (XSS) flaw that allows a remote, unauthenticated attacker to execute arbitrary JavaScript code in the context of an administrator session. User interaction is required for exploitation. Approximately 1,898 instances of Ivanti Endpoint Manager are exposed, with 80 identified as vulnerable. The flaw enables attackers to potentially hijack administrator sessions. Attackers can exploit the vulnerability by submitting malicious device scan data, leading to JavaScript execution. Exposed instances have been identified in the U.S., Germany, and Japan.
Recommendations Upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15631
CVE-2025-10573

Affected Products

Ivanti Endpoint Manager