Ivanti Endpoint Manager Vulnerabilities Allow Remote Code Execution by Attackers

According to Ivanti, Ivanti released Security Advisory for Endpoint Manager versions 2024 SU3 and 2022 SU8, detailing two high-severity flaws (CVE-2025-9712 and CVE-2025-9872). The vulnerabilities arise from insufficient filename validation and can allow remote unauthenticated code execution with user interaction, giving attackers potential full control over affected systems.

Ivanti notes CVSS scores of 8.8 (High) for both CVEs, and states there is no known exploitation of these flaws in the wild at the time of disclosure. Affected installations run 2022 SU8 Security Update 1 or earlier, as well as 2024 SU3 and prior, with fixes released in 2022 SU8 Security Update 2 and 2024 SU3 Security Update 1, respectively, available via the Ivanti License System. The 2022 branch will reach End of Life at the end of October 2025, and organisations are advised to migrate to a supported version.

Administrators should verify their Endpoint Manager version, apply the appropriate security update, review access controls, and plan for the 2022 branch migration to maintain ongoing security and support.