Ivanti Endpoint Manager CVE-2025-13659

Exploitation targets the Ivanti Endpoint Manager server and requires network reachability to it plus the required user/operator interaction indicated by UI:R - the attacker cannot complete the attack fully autonomously and must get a user or administrator to perform some action that triggers the arbitrary file write. The flaw affects EPM versions prior to 2024 SU4 SR1 (2024 base through SU4, including SU3 Security Release 1); the primary limiting factors are the mandatory user interaction and the version boundary. No valid credentials are required (PR:N). The exact triggering action is not detailed in the advisory data provided and should be confirmed against Ivanti's EPM December 2025 advisory to assess realistic risk.

This is a credible high-priority issue, though not a drop-everything emergency on current signals. The vendor-confirmed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact - an arbitrary file write (CWE-913, improper control of dynamically managed code resources) that can escalate to remote code execution on the EPM server. The single mitigating metric is UI:R: successful exploitation requires some user/operator interaction, which lowers the realistic probability versus a fully autonomous AV:N/UI:N bug. On the threat-intelligence side the signals are weaker/absent: no EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced - so there is no evidence of active exploitation or weaponization yet. The result is a classic 'high CVSS, unproven real-world exploitation' profile: severity is genuine and the target (a centralized endpoint-management server) is high-value, but priority should be driven by Ivanti's historical status as a heavily targeted vendor rather than by confirmed in-the-wild activity. MISSING DATA: EPSS, KEV, and POC status were all absent from the input and cannot be inferred; the exact nature of the required 'user interaction' is not described, which materially affects exploitability and should be verified against the Ivanti advisory.

A remote, unauthenticated attacker reaches the Ivanti Endpoint Manager server over the network and induces an operator or user to perform the required interaction (e.g., opening or processing attacker-influenced content), triggering an arbitrary file write to a location that leads to code execution. By writing a malicious file into a web-accessible or auto-executed path, the attacker can achieve remote code execution on the EPM server, which centrally manages enterprise endpoints. No public exploit code is identified at time of analysis, so a working exploit would currently require independent development.