Ivanti Patches 13 Endpoint Manager Flaws Allowing Remote Code Execution

Ivanti has disclosed 13 vulnerabilities in Ivanti Endpoint Manager (EPM), including two high-severity issues that could enable privilege escalation and remote code execution, and eleven medium-severity SQL injection flaws.

The two most critical flaws are CVE-2025-11622, an insecure deserialization issue that allows a local authenticated attacker to escalate privileges (CVSS 7.8, CWE-502), and CVE-2025-9713, a path traversal that enables remote code execution by an unauthenticated attacker but requires user interaction (CVSS 8.8, CWE-22). The remaining eleven CVEs are SQL injection weaknesses that allow remote authenticated users to read arbitrary database data (CVSS 6.5, CWE-89).

Mitigations vary by flaw, with the insecure deserialization and path traversal bugs set for Ivanti EPM 2024 SU4, targeted for 12 November 2025, and the SQL injection set for EPM 2024 SU5 in Q1 2026, while workarounds are advised in the interim.

For context, Ivanti stated EPM 2022 reached end-of-life in October 2025, and patches are still in development, with administrators urged to harden and limit access in the meantime, and to upgrade to EPM 2024 where possible, and to review administrative access and firewall rules. According to Ivanti, the vulnerability disclosures credit researcher 06fe5fd2bc53027c4a3b7e395af0b850e7b8a044, who worked with Trend Micro’s Zero Day Initiative. There is no evidence of in-the-wild exploitation reported in the article.