What is the CVSS score of CVE-2025-11622?

CVE-2025-11622 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Ivanti Endpoint Manager are affected by CVE-2025-11622?

Ivanti Endpoint Manager builds prior to 2024 SU4 contain a local privilege-escalation flaw that lets an authenticated low-privilege user on an affected EPM server gain high-integrity control of that…

How to fix or mitigate CVE-2025-11622?

Within 24 hours, inventory all Ivanti Endpoint Manager instances and confirm build levels: 2024 base, SU1, SU2, SU3, and SU3 Security Release 1 are affected, while 2024 SU4 or later are not affected; restrict local interactive logon and administrative access to EPM servers to essential trusted personnel, review and disable unnecessary local accounts, and enable EDR and Windows event logging for suspicious deserialization or privilege-escalation activity on EPM hosts. Within 7 days, enforce least privilege for any remaining local users, remove cached credentials and unnecessary admin group memberships, segment EPM servers from general user networks, and monitor vendor advisories for a fixed build since no vendor-released patch was identified at time of analysis; because the CVSS vector indicates PR:L and AV:L, an attacker needs authenticated local access, so focus on reducing that attack surface. Within 30 days, if an affected build cannot be upgraded, formalize compensating controls such as application allowlisting, restricted local and remote access, enhanced monitoring, and incident-response playbooks for EPM host compromise, and plan migration to a non-affected build such as 2024 SU4 or later when approved for production.

Ivanti Endpoint Manager CVE-2025-11622

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-13 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Deserialization Ivanti Endpoint Manager

7.8

CVSS 3.1 · Vendor: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Severity by source

Vendor (3c1d8aa1-5a33-4ea4-8992-aadd6440af75) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local privilege escalation requiring an existing low-privileged authenticated session (AV:L, PR:L); deserialization yields code execution with full C/I/A impact and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (3c1d8aa1-5a33-4ea4-8992-aadd6440af75).

CVSS VectorVendor: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:33 vuln.today

CVE Published

Oct 13, 2025 - 21:15 cve.org

HIGH 7.8

DescriptionCVE.org

Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.

AnalysisAI

Local privilege escalation in Ivanti Endpoint Manager allows an authenticated low-privilege attacker to gain high-integrity control of the host by feeding attacker-controlled serialized data into a vulnerable deserialization path in the EPM software. Affected builds are all EPM versions prior to 2024 SU4, specifically the 2024 base release and service updates SU1, SU2, SU3, and SU3 Security Release 1; systems already on 2024 SU4 or later are not affected. The attack requires an existing local authenticated session (PR:L, AV:L, no user interaction) and is not remotely reachable by an unauthenticated attacker; no public exploit identified at time of analysis, and EPSS is low at 0.78% (55th percentile), so this is a credible but not emergency-tier priority for most environments.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data. Ivanti Endpoint Manager - a Windows agents-and-server management platform - processes serialized object structures internally, and a vulnerable path accepts data that an attacker can influence, causing the deserializer to instantiate attacker-chosen types and execute code with the privileges of the EPM component performing the deserialization. Because the flaw sits behind local access and a valid low-privilege session, the serialized payload is supplied from the local system context rather than over an unauthenticated network channel, which is why the vector is AV:L/PR:L. The CPE data enumerates the vulnerable build set as cpe:2.3:a:ivanti:endpoint_manager:2024 (base), 2024:su1, 2024:su2, 2024:su3, and 2024:su3_security_release_1, plus the generic wildcard entry for all versions, indicating the fix boundary was drawn at the 2024 SU4 release. Successful exploitation yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H) on the local host, but scope is unchanged (S:U), so impact is contained to the vulnerable EPM installation and its host rather than spreading to adjacent systems.

RemediationAI

Vendor-released patch: upgrade Ivanti Endpoint Manager to 2024 SU4 or later - this is the release boundary at which the deserialization flaw is fixed, and it applies to the 2024 base install and to SU1, SU2, SU3, and SU3 Security Release 1 builds; follow the instructions in the Ivanti advisory at https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025. Because the prerequisite is already-present local authenticated access, the highest-value compensating controls until patching completes are to constrain who can log on interactively or via RDP to EPM hosts (remove non-admin interactive rights from standard users), to harden the EPM service account and any agent-spawned processes so a low-privilege session cannot reach privileged EPM components, and to monitor for unexpected child processes or unusual object-instantiation activity originating from EPM services; each of these reduces exposure to the escalation primitive but does not remove the underlying deserialization weakness, so they are stopgaps only and should be paired with an expedited upgrade window. Note the trade-off that tightening interactive logon rights on management servers can disrupt administrative workflows and break delegated operational roles, so coordinate with the teams that use those hosts before enforcing it.