What is the CVSS score of CVE-2025-9713?

CVE-2025-9713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 15.3%.

Which versions of Ivanti Endpoint Manager are affected by CVE-2025-9713?

Ivanti Endpoint Manager - the platform our IT teams rely on to configure, patch, and control endpoints organization-wide - carries a high-severity remote code execution flaw in versions up to 2024…

How to fix or mitigate CVE-2025-9713?

Within 24 hours, inventory every Ivanti Endpoint Manager deployment and record the exact build, flagging any instance running 2024, 2024 SU1, SU2, SU3, or SU3 Security Release 1 as affected; simultaneously restrict management-console and server access to trusted administrative networks only and enable verbose logging on the EPM server to catch directory-traversal attempts around file-handling paths. Within 7 days, schedule and begin the upgrade to Ivanti Endpoint Manager 2024 SU4, the vendor-documented fixed release, prioritizing any instance that is internet-facing or that manages the largest or most sensitive endpoint population, and confirm the upgrade path against Ivanti's published advisory since the affected releases carry cumulative fixes. Within 30 days, complete the 2024 SU4 upgrade across all remaining instances, verify post-upgrade that no affected build is still reporting into inventory, and review EPM and perimeter logs for indicators of traversal or unexpected process execution; where an instance cannot be upgraded on schedule, keep it network-isolated and under enhanced monitoring until it can be.

Ivanti Endpoint Manager CVE-2025-9713

HIGH

Path Traversal (CWE-22)

2025-10-13 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

RCE Path Traversal Ivanti Endpoint Manager

8.8

CVSS 3.1 · Vendor: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Severity by source

Vendor (3c1d8aa1-5a33-4ea4-8992-aadd6440af75) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity, unauthenticated path traversal to RCE with full CIA impact; UI:R because a user must trigger the crafted payload, keeping it below 9.8.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (3c1d8aa1-5a33-4ea4-8992-aadd6440af75).

CVSS VectorVendor: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 23:58 vuln.today

CVE Published

Oct 13, 2025 - 21:15 cve.org

HIGH 8.8

DescriptionCVE.org

Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

AnalysisAI

Remote code execution in Ivanti Endpoint Manager before version 2024 SU4 is achievable via a path-traversal flaw (CWE-22) that allows an unauthenticated remote attacker to escape intended directories and execute code on the EPM server, though the attack requires user interaction (UI:R) and thus cannot be fully autonomous. Affected versions include 2024, 2024 SU1, SU2, SU3, and SU3 Security Release 1, all fixed by upgrading to 2024 SU4. With an EPSS score of 15.33% (97th percentile) and no public exploit code or confirmed active exploitation identified at time of analysis, this is assessed as a high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.

Technical ContextAI

Ivanti Endpoint Manager (EPM) is an endpoint management platform used for patch management, software distribution, and security configuration. The vulnerability is a path traversal (CWE-22) that enables an attacker to use crafted input to navigate outside a restricted directory, potentially reading or writing arbitrary files. By writing a malicious file to a location that is later executed by the EPM service, an attacker chains the traversal to remote code execution. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the attack is network-accessible, requires no authentication, but demands user interaction-meaning a user with EPM access must be induced to trigger the crafted payload-which limits automated exploitation. The affected CPEs cover all versions prior to 2024 SU4, including the 2024 release and its service updates and security release.

RemediationAI

Vendor-released patch: upgrade to Ivanti Endpoint Manager 2024 SU4 or later as directed in the advisory at https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025. If immediate upgrade is not feasible, compensating controls should focus on reducing the attack surface: restrict network access to EPM servers via firewall rules or VPN segmentation to limit reachable instances (trade-off: may disrupt legitimate remote management), and reinforce user awareness to mitigate the UI:R requirement by preventing users from opening untrusted files or links that could trigger the payload (trade-off: relies on human behavior). No vendor-released workaround is specified in the advisory; these measures are temporary until patching is possible.