High WID-SEC-2025-2796 4 CVEs

Ivanti Endpoint Manager: Mehrere Schwachstellen

Published Dec 9, 2025 · Updated Dec 9, 2025 · de-DE

Vendor: ivanti Product: Endpoint Manager Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager ausnutzen, um Cross-Site-Scripting-Angriffe zu starten, beliebigen Code auszuführen und Daten zu manipulieren.

Product

Ivanti Endpoint Manager ist eine Endpoint Management Software zur zentralen Verwaltung von Benutzerprofilen und -Geräten.

Vulnerabilities 4

Critical 9.6

CVE-2025-10573 EPSS 34%

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute…

ivanti Endpoint Manager Network devices

Dec 9, 2025
High 8.8

CVE-2025-13659

Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows …

ivanti Endpoint Manager Network devices

Dec 9, 2025
High 7.8

CVE-2025-13662

Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to…

ivanti Endpoint Manager Network devices

Dec 9, 2025
High 7.1

CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write…

ivanti Endpoint Manager Network devices

Dec 9, 2025

Revision history

2025-12-09 #1
Initiale Fassung

References

Ivanti Security Advisory EPM December 2025 for EPM 2024 vom 2025-12-09
https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024?language=en_US