Ivanti Endpoint Manager fixes 13 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti Endpoint Manager fixes 13 vulnerabilities

Ivanti warns of 13 vulnerabilities in Ivanti Endpoint Manager. Fixes will be released in versions 2024 SU4 (12 November 2025) and 2024 SU5 (Q1 2026). For mitigation or a temporary workaround, follow [1].

Ivanti Endpoint Manager - RCE (CVE-2025-9713)

CVSS 8.8 (High)

Allows an unauthenticated remote attacker to execute code due to a path traversal vulnerability [1].

The vulnerability is present in product:

Ivanti Endpoint Manager; <=2024 SU3 SR1; <=2022 SU8 SR2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

CVE-2025-9713 at cve.org, NVD
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 10. 2025.

Ivanti Endpoint Manager - privilege escalation (CVE-2025-11622)

CVSS 7.8 (High)

Allows an authenticated local attacker to escalate privileges due to insecure deserialization [1].

The vulnerability is present in product:

Ivanti Endpoint Manager; <=2024 SU3 SR1; <=2022 SU8 SR2

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2025-11622 at cve.org, NVD
CWE-502: Deserialization of Untrusted Data at cwe.mitre.org

The vulnerability was publicly disclosed 13. 10. 2025.

Ivanti Endpoint Manager - SQL injection (CVE-2025-11623, CVE-2025-62392, CVE-2025-62390, CVE-2025-62389, CVE-2025-62388, CVE-2025-62387, CVE-2025-62385, CVE-2025-62391, CVE-2025-62383, CVE-2025-62386, CVE-2025-62384)

CVSS 6.5 (Medium)

Allows an authenticated remote attacker to perform an SQL injection attack and read arbitrary data from the database [1].

The vulnerability is present in product:

Ivanti Endpoint Manager; <=2024 SU3 SR1; <=2022 SU8 SR2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

CVE-2025-11623 at cve.org, NVD
CVE-2025-62392 at cve.org, NVD
CVE-2025-62390 at cve.org, NVD
CVE-2025-62389 at cve.org, NVD
CVE-2025-62388 at cve.org, NVD
CVE-2025-62387 at cve.org, NVD
CVE-2025-62385 at cve.org, NVD
CVE-2025-62391 at cve.org, NVD
CVE-2025-62383 at cve.org, NVD
CVE-2025-62386 at cve.org, NVD
CVE-2025-62384 at cve.org, NVD
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 10. 2025.

Report feedback

[TLP:CLEAR] Ivanti Endpoint Manager fixes 13 vulnerabilities

Ivanti Endpoint Manager - RCE (CVE-2025-9713)

CVSS 8.8 (High)

Ivanti Endpoint Manager - privilege escalation (CVE-2025-11622)

CVSS 7.8 (High)

Ivanti Endpoint Manager - SQL injection (CVE-2025-11623, CVE-2025-62392, CVE-2025-62390, CVE-2025-62389, CVE-2025-62388, CVE-2025-62387, CVE-2025-62385, CVE-2025-62391, CVE-2025-62383, CVE-2025-62386, CVE-2025-62384)

CVSS 6.5 (Medium)

Links