Critical Ivanti EPM Flaw (CVE-2025-10573) Risks Admin Session Hijack and Unauthenticated RCE

Ivanti has rolled out an urgent security update for Endpoint Manager (EPM), patching a cluster of vulnerabilities that could allow attackers to execute arbitrary code or hijack administrator sessions.

The most severe flaw, CVE-2025-10573, is a Stored XSS with a CVSS of 9.6 that affects EPM versions prior to 2024 SU4 SR1, and, according to the advisory, “allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session.” While user interaction is likely required to lure an admin into a malicious page, the potential for full session hijacking marks it as a top defender priority.

Alongside the critical XSS, Ivanti patched three high-severity issues: Arbitrary File Write (CVE-2025-13659, CVSS 8.8), remote unauthenticated file writes that could lead to remote code execution; Signature Verification Failure (CVE-2025-13662, CVSS 7.8), which allows remote unauthenticated code execution but requires user interaction; and Path Traversal (CVE-2025-13661, CVSS 7.1), enabling an authenticated attacker to write arbitrary files outside the intended directory.

The vulnerabilities affect Ivanti Endpoint Manager 2024 SU4 and earlier, with Ivanti releasing 2024 SU4 SR 1 to resolve them; the company says it is not aware of any exploited customers at disclosure and urges immediate patching, while advising those unable to patch to review network exposure and verify connection and file sources, as exploitation relies on untrusted core servers or configuration files, according to advisory.