Latest Ivanti Endpoint Manager vulnerabilities #
On October 7th, 2025, the Zero Day Initiative (ZDI) disclosed thirteen unpatched vulnerabilities affecting undisclosed versions of Ivanti Endpoint Manager (EPM). A fourteenth vulnerability, ZDI-25-952, was disclosed on October 10th, 2025, and Ivanti has made patches available to resolve it.
While many of the remote code execution (RCE) vulnerabilities require a high-privileged adversary, three are particularly noteworthy because they have a lower barrier for exploitation. ZDI-25-935 and ZDI-25-952 allow a remote, unauthenticated adversary to achieve RCE with user interaction. The third, ZDI-25-947, enables a local, low-privileged adversary to escalate privileges and achieve RCE.
- An RCE vulnerability exists because the OnSaveToDB method fails to properly validate a user-supplied path, creating a path traversal flaw. A remote adversary can exploit this by either tricking a user into visiting a malicious webpage or opening a malicious file, or by using administrative credentials to attack the application directly without any user interaction. Successful exploitation allows the adversary to execute arbitrary code with the privileges of the current user. This vulnerability has been designated ZDI-25-935 and has been rated high with a CVSS score of 8.8.
- A SQL injection vulnerability within the Report_Run2 class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-936 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the Report_Run class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-937 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the Report_RunPatch class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-938 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the MP_VistaReport class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-939 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the MP_QueryDetail class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-940 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the GetCountForQuery class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-941 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the MP_QueryDetail2 class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-942 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the PatchHistory class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-943 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the DBDR class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-944 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the MP_Report_Run2 class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-945 and has been rated high with a CVSS score of 7.2.
- A SQL injection vulnerability within the Report_RunPatch class allows a remote, high-privileged adversary to achieve RCE. The flaw stems from the application's failure to properly validate a user-supplied string before using it to build SQL queries. Successful exploitation allows the adversary to execute arbitrary code in the context of the service account. This vulnerability has been designated ZDI-25-946 and has been rated high with a CVSS score of 7.2.
- An insecure deserialization vulnerability in the AgentPortal service allows a local, low-privileged adversary to escalate privileges. The flaw stems from the service's failure to properly validate user-supplied data, which can be leveraged to execute arbitrary code in the context of SYSTEM. Successful exploitation requires the adversary first possess the ability to execute low-privileged code on the target system. This vulnerability has been designated ZDI-25-947 and has been rated high with a CVSS score of 7.8.
- An arbitrary file upload vulnerability allows for RCE. The flaw exists in the processing of the UniqueFilename attribute or tag, where a lack of proper data validation allows arbitrary files to be uploaded. A remote adversary can exploit this by either tricking a user into visiting a malicious webpage or opening a malicious file, or by using administrative credentials to attack the application directly without any user interaction. Successful exploitation allows the adversary to execute arbitrary code in the context of NETWORK SERVICE. This vulnerability has been designated ZDI-25-952 (CVE-2025-9712, CVE-2025-9872) and has been rated high with a CVSS score of 8.8.
The following versions are affected by ZDI-25-952 (CVE-2025-9712 & CVE-2025-9872)
- Ivanti Endpoint Manager versions 2022 SU8 Security Update 1 and prior
- Ivanti Endpoint Manager versions 2024 SU3 and prior
The following versions are affected by the other vulnerabilities
- Ivanti Endpoint Manager unknown versions
What is Ivanti Endpoint Manager? #
Ivanti Endpoint Manager (EPM) is a Unified Endpoint Management (UEM) suite that gives IT teams centralized control to discover, manage, secure, and service all their endpoints, providing deep visibility and simplifying complex tasks like patch remediation and software deployment.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Upgrade affected systems to the new versions to resolve ZDI-25-952 (CVE-2025-9712 & CVE-2025-9872):
- Ivanti Endpoint Manager upgrade to version 2022 SU8 Security Release 2 or later
- Ivanti Endpoint Manager upgrade to version 2024 SU3 Security Release 1 or later
Since the vendor has not yet released security patches addressing all of the vulnerabilities, evaluate the risk of exposing these installations to the Internet. As a primary mitigation, implement network access controls to restrict access to only trusted IP ranges.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Ivanti product:="Endpoint Manager"Currently, runZero prebuilt integrations can identify these findings.
