Ivanti EPM Update Patches Critical Remote Code Execution Flaw

Ivanti has released patches for four vulnerabilities in Endpoint Manager (EPM), including a critical remote code execution flaw tracked as CVE-2025-10573 (CVSS 9.6) that is described as a stored XSS issue exploitable without authentication. The bug can be triggered by devices sending scan data through the EPM API, with the payload processed on the admin dashboard to execute JavaScript in the administrator’s session, potentially giving an attacker control of that session.

Ivanti notes the fixes are delivered in EPM 2024 SU4 SR1, which also resolves three high-severity flaws: CVE-2025-13659 (remote unauthenticated RCE via improper control of dynamically managed code resources), CVE-2025-13661 (path traversal requiring authentication to write files outside the intended directory), and CVE-2025-13662 (improper verification of cryptographic signatures in patch management, enabling remote unauthenticated RCE with user interaction).

According to Rapid7, the critical issue could be exploited by submitting malicious device scan data that is embedded in the web dashboard, and Ivanti states it is not aware of any active exploitation in the wild. Ivanti urges users to update to the latest EPM versions as soon as possible.