Ivanti Endpoint Manager CVE-2025-13662

Exploitation requires the attacker to supply a crafted patch/update package to the Ivanti Endpoint Manager patch management component whose forged or invalid cryptographic signature is not properly verified (CWE-347), AND requires user interaction (UI:R) - an operator or process must apply/process the malicious update for code execution to occur. Limiting factors: the vendor CVSS specifies a LOCAL attack vector (AV:L), so network reachability is not confirmed despite the description's 'remote' wording; the mandatory user-interaction step means it is not a hands-off remote exploit; and only Endpoint Manager builds at or below 2024 SU4 (including 2024, SU1, SU2, SU3, SU3 SR1, SU4) are affected - 2024 SU4 SR1 and later contain the fix.

This is a signature-verification flaw (CWE-347) in the patch management component of Ivanti Endpoint Manager that permits arbitrary code execution. The signals are mixed and partially conflicting, which must be stated explicitly: the vendor CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 7.8), which describes a LOCAL attack vector requiring user interaction, yet the NVD description calls the actor a 'remote unauthenticated attacker' - this AV:L-versus-'remote' discrepancy should be verified with Ivanti before treating the flaw as network-reachable. No EPSS probability was provided, the CVE is NOT on CISA KEV, and no POC was indicated, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Weighing these together: the technical impact is high (full C/I/A), and Ivanti EPM is a high-value administrative/enterprise target historically attracting attackers, but the real-world barrier is meaningful - exploitation hinges on user interaction (UI:R) and, per the vendor vector, local access. This is a credible priority to patch for organizations running EPM, but it is not currently a mass-exploitation emergency: absent KEV/EPSS/POC signals, risk is elevated-but-conditional rather than confirmed widespread. Treat as important patch-now-for-affected-admins, pending vendor clarification of the remote-vs-local contradiction.

An attacker crafts a malicious software patch or update package that the Endpoint Manager patch management component fails to properly validate the cryptographic signature of. When an operator/user is induced to apply or process the crafted update (UI:R), the unverified payload runs with the privileges of the patch management workflow, yielding arbitrary code execution. No public POC is known, and per the vendor CVSS the attacker needs local access to the affected system or workflow.