CVE-2025-10573

Critical

Published: 09/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Ivanti Endpoint Manager prior to version 2024 SU4 SR1 contains a stored XSS vulnerability that allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Risk Assessment

An attacker could hijack an administrator session and execute malicious scripts, potentially leading to data confidentiality breach or system takeover.

Recommendation

Upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later to remediate the vulnerability.

Original NVD description (English source)

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.