CVE-2025-10986
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A path traversal vulnerability exists in the admin panel of Ivanti EPMM before versions 12.6.0.2, 12.5.0.4, and 12.4.0.4. A remote authenticated attacker with admin privileges can write data to unintended locations on disk.
Risk Assessment
An attacker with admin privileges could overwrite critical system or configuration files, potentially leading to system integrity compromise or privilege escalation. This could also enable persistent control over the system.
Recommendation
It is recommended to immediately update Ivanti EPMM to a patched version (12.6.0.2, 12.5.0.4, or 12.4.0.4). Additionally, restrict admin privileges and monitor for unusual write operations.
Other vulnerabilities in Ivanti EPMM
See all- CVE-2026-7821High
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
- CVE-2026-5788High
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
- CVE-2026-5787High
Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 has improper certificate validation, allowing a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
- CVE-2026-5786High
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
- CVE-2026-6973HighActively exploited
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
- CVE-2025-10985High
OS command injection in the admin panel of Ivanti EPMM before versions 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CVE-2025-10243High
OS command injection in the admin panel of Ivanti EPMM before versions 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CVE-2025-10242High
OS command injection in the Ivanti EPMM admin panel before versions 12.6.0.2, 12.5.0.4, and 12.4.0.4. A remote authenticated attacker with admin privileges can achieve remote code execution.
- CVE-2023-35081HighActively exploited
A path traversal vulnerability in Ivanti EPMM allows an authenticated administrator to write arbitrary files onto the appliance. It affects versions 11.10.x before 11.10.0.3, 11.9.x before 11.9.1.2, and 11.8.x before 11.8.1.2.
- CVE-2023-35078CriticalActively exploited
CVE-2023-35078 describes an authentication bypass vulnerability in Ivanti EPMM that allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
Original NVD description (English source)
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS