SB2025120941 - Multiple vulnerabilities in Ivanti Endpoint Manager (EPM)

Security Bulletin ID SB2025120941

Severity

High

Patch available

YES

Number of vulnerabilities 4

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Stored cross-site scripting (CVE-ID: CVE-2025-10573)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote non-authenticated attacker can permanently inject and execute arbitrary HTML and script code in administrator's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

2) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2025-13659)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper control of dynamically managed code resources. A remote non-authenticated attacker can write arbitrary files on the server and execute arbitrary code on the system.

3) Path traversal (CVE-ID: CVE-2025-13661)

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and write arbitrary files outside of the intended directory, leading to remote code execution.

4) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2025-13662)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper verification of cryptographic signature in the patch management component. A remote non-authenticated attacker can supply a malicious patch, trick the administrator into installing it and compromise the affected system.

Remediation

Install update from vendor's website.

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024?language=en_US&_gl=1*1enaa74*_gcl_au*NDAxNzU2MDQxLjE3NjUzMDE2MTA.