ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities

According to Trend Micro’s Zero Day Initiative (ZDI), this week it published 13 advisories describing unpatched vulnerabilities in Ivanti Endpoint Manager. The disclosures include one local privilege escalation affecting the Endpoint Manager’s AgentPortal service, reported to Ivanti in November 2024, and 12 remote code execution flaws reported in June 2025.

No CVEs have been issued, but ZDI notes all are high-severity defects, with the most severe scoring 8.8 on the CVSS scale, another at 7.8, and the remaining 11 at 7.2.

The RCE weaknesses stem from improperly validated input used in constructing SQL queries or in file operations across multiple components, with authentication required to exploit the first 11, while the final 8.8‑score flaw could allow code execution in the context of the user if admin credentials are held or a user is enticed to open a malicious page or file.

Ivanti was notified of the first vulnerability in November 2024 and acknowledged it in January 2025; patches for the RCE flaws were initially promised for September but extended to March 2026, according to ZDI’s disclosure policy.