Ivanti Endpoint Manager Vulnerabilities Let Attackers Write Files Anywhere on Target Systems

Ivanti Endpoint Manager has three high-severity vulnerabilities that could allow authenticated attackers to write arbitrary files to any location on affected systems. The company disclosed the advisory on 10 November 2025, and patches are available through the Ivanti License System, with the fix to be included in Endpoint Manager 2024 SU4.

The most concerning flaw, CVE-2025-10918, arises from insecure default permissions in the agent and could let local attackers write across the entire system disk, potentially compromising integrity and enabling further attacks; it carries a CVSS score of 7.1. Two additional CVEs, CVE-2025-9713 and CVE-2025-11622, were previously disclosed in October 2025 and are described as high severity.

The vulnerabilities affect Ivanti Endpoint Manager versions 2024 SU3 SR1 and earlier, and Ivanti has urged organisations to deploy the 2024 SU4 upgrade promptly, noting that support for the older 2022 branch ended at the end of October 2025. According to Ivanti, at disclosure time no customers were actively exploiting these vulnerabilities, and the company acknowledged security researcher Enrique Fernández Lorenzo (aka bighound) for responsibly disclosing CVE-2025-10918.