Ivanti Patches Two High-Severity RCE Flaws in Endpoint Manager

Ivanti has released security updates for Endpoint Manager (EPM) addressing two high-severity remote code execution vulnerabilities caused by insufficient filename validation, both with a CVSS score of 8.8. According to Ivanti, CVE-2025-9712 allows a remote unauthenticated attacker to achieve remote code execution and requires user interaction; a second flaw, CVE-2025-9872, is described similarly.

Both flaws pose a serious risk to enterprises running outdated EPM versions, particularly if malicious files can be uploaded to trigger code execution on endpoints. The advisory lists Ivanti Endpoint Manager 2022 SU8 Security Update 1 and prior, and 2024 SU3 and prior as affected, with fixes in Ivanti Endpoint Manager 2022 SU8 Security Update 2 and 2024 SU3 Security Update 1.

While Ivanti notes that no customers were known to be exploited at the time of disclosure, exploitation only requires limited user interaction, so unpatched systems remain at risk. Ivanti strongly urges customers to upgrade to the latest patched versions via its software download portal and to prepare for migration from the 2022 branch before its end-of-life date in October 2025.