Ivanti EPMM CVE-2025-10986

Requires an authenticated session to the Ivanti EPMM administrative panel with administrator privileges (CVSS PR:H) - this is the primary limiting factor and means the flaw is not exploitable by unauthenticated or low-privileged users. No special non-default configuration is indicated by the description; the path traversal is in the admin panel itself. Affected deployments are Ivanti EPMM (formerly MobileIron Core) before 12.6.0.2, 12.5.0.4, and 12.4.0.4. No user interaction is required (UI:N). The realistic risk is confined to scenarios where admin credentials are already compromised or where this is chained with a separate authentication-bypass flaw.

This is a lower-tier priority despite being a path traversal in a security-sensitive Ivanti EPMM appliance. The CVSS 3.1 base score is 5.5 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - network reachable and low-complexity, but gated behind PR:H, meaning the attacker must already hold admin-level credentials to the EPMM admin panel. This high privilege prerequisite is the dominant risk-limiting factor: an attacker who already has admin access has substantial control, so the marginal gain of arbitrary file write is incremental rather than a privilege-escalation primitive granting initial access. EPSS is 0.62% (48th percentile), indicating low modeled exploitation probability, consistent with the absence of both CISA KEV listing and any public POC. No SSVC decision data was provided in the input. Signals are mutually consistent here: low EPSS, no KEV, no POC, and a high-privilege requirement all point to a genuinely medium/low real-world risk rather than a high-CVSS-but-overstated issue. The one notable consideration is the vendor: Ivanti edge/management products have a strong recent history of chained and actively exploited flaws, so this write primitive could plausibly become valuable as a post-authentication link in a larger exploit chain - but as an isolated issue it is not urgent.

An attacker who has already obtained or compromised EPMM administrator credentials sends a crafted request to the admin panel containing path traversal sequences, causing the server to write attacker-controlled data to a file location outside the intended directory. This could be used to drop or overwrite files on disk (potentially staging code execution or tampering with appliance integrity), but requires pre-existing admin access. No public exploit identified at time of analysis.