Ivanti warns customers of new EPM flaw enabling remote code execution

Ivanti has disclosed a newly published vulnerability in its Endpoint Manager (EPM) solution, tracked as CVE-2025-10573 with a CVSS score of 9.6, described as a Stored XSS that could allow a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session, with user interaction required. The flaw affects EPM versions prior to 2024 SU4 SR1, and Ivanti notes that EPM is widely used for remote administration and vulnerability management, making it an attractive target.

Rapid7 warns that an unauthenticated attacker can register fake endpoints with Ivanti EPM and inject malicious JavaScript into the admin dashboard; when an administrator views the poisoned interface, the script executes and the attacker can hijack the administrator’s session, with no authentication required. Ivanti states there are no known attacks in the wild exploiting this vulnerability. According to CISA, in March it added multiple EPM vulnerabilities to its Known Exploited Vulnerabilities catalog.