Ivanti Endpoint Manager
CVE-2025-10573
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection (PR:N, AV:N) that requires an admin to view the stored payload (UI:R) and executes in a different privileged context (S:C), yielding limited C/I impact and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
AnalysisAI
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3 Security Release 1) lets a remote unauthenticated attacker plant a persistent JavaScript payload that executes in the browser context of an administrator's EPM console session once that administrator views the poisoned page. Because the script runs inside an authenticated admin session, it can read or modify administrative data and perform actions as the victim, though the scope-limited CVSS impact (C:L/I:L/A:N) and the mandatory administrator interaction (UI:R) constrain the damage. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, but the EPSS score is elevated at 33.50% (98th percentile), indicating strong model-based likelihood of exploitation attempts; the vendor fix is Ivanti Endpoint Manager 2024 SU4 SR1.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored/persistent variant: Ivanti Endpoint Manager exposes a web-reachable input path that accepts data from unauthenticated users (CVSS PR:N) and later renders that data unsanitized inside the administrative web console. Because the payload is persisted server-side and replayed to a different user (the administrator), the XSS executes in the privileged origin, and the CVSS vector's Scope:Changed (S:C) reflects that the injected script affects resources beyond the vulnerable component's original security authority - an admin-session compromise rather than a simple page defacement. Confidentiality and integrity impacts are rated Low (C:L/I:L) with no availability impact (A:N), and User Interaction:Required (UI:R) means an administrator must navigate to the page that renders the stored payload. The CPE data maps the affected line to Ivanti Endpoint Manager 2024 at the base release and the SU1, SU2, SU3, SU3 Security Release 1 and SU4 service-update levels, plus a generic wildcard entry for the product, i.e., every 2024 build before SU4 SR1. The unauthenticated injection requirement implies a self-service, agent-enrollment, or similar pre-authentication web surface in EPM that stores attacker-controlled content later displayed to admins - a classic stored-XSS trust-boundary crossing between an untrusted anonymous input channel and the trusted administrative UI.
RemediationAI
Upgrade to Ivanti Endpoint Manager 2024 SU4 SR1, the vendor-released patch that remediates this flaw; Ivanti's guidance is published in Security Advisory EPM December 2025 for EPM 2024 (https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024), which should be followed for exact build numbers and upgrade sequencing. If the upgrade cannot be applied immediately, reduce exposure by restricting network access to the EPM administrative console to trusted management networks or VPN-only admin access and by blocking untrusted external access to the pre-authentication web endpoints that accept anonymous input - the trade-off is that remote/self-service flows and distributed admin access will break until those paths are re-exposed. Because the flaw is stored XSS, adding a restrictive Content-Security-Policy to the EPM web tier can blunt script execution as a defense-in-depth measure, but this requires application compatibility testing and cannot be relied on as the primary fix since inline script usage is common in enterprise consoles. Finally, treat administrator sessions as potentially compromised: rotate administrative credentials, review EPM audit logs for unexpected admin actions, and clear cached/persisted content after patching, while noting that no public exploit code was identified at time of analysis yet the elevated EPSS score (33.50%) argues for prompt patching rather than deferred maintenance.
More in Endpoint Manager
View allIvanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthen
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device r
Remote code execution in Ivanti Endpoint Manager before version 2024 SU4 is achievable via a path-traversal flaw (CWE-22
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an aut
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allow
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unau
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today