CVE-2025-9713
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Path traversal vulnerability in Ivanti Endpoint Manager before version 2024 SU4. A remote unauthenticated attacker can achieve remote code execution, though user interaction is required.
Risk Assessment
Unauthenticated remote code execution poses a high risk of taking control of the endpoint management system.
Recommendation
Update Ivanti Endpoint Manager to version 2024 SU4 or later.
Other vulnerabilities in Ivanti Endpoint Manager
See all- CVE-2026-8111High
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
- CVE-2026-8110High
In Ivanti Endpoint Manager before version 2024 SU6, incorrect permissions assignment in the agent allows a local authenticated attacker to escalate their privileges.
- CVE-2025-10573Critical
Ivanti Endpoint Manager prior to version 2024 SU4 SR1 contains a stored XSS vulnerability that allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
- CVE-2025-9872High
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- CVE-2026-18129High
Ivanti Endpoint Manager before 2024 SU7 transmits sensitive information in cleartext, allowing a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
- CVE-2026-18127High
Ivanti Endpoint Manager before 2024 SU7 has a vulnerability related to external control of a filename, allowing a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
- CVE-2026-18125High
Ivanti Endpoint Manager before 2024 SU7 has an out-of-bounds read vulnerability in the Agent, allowing a remote unauthenticated attacker to crash an agent service.
- CVE-2025-62386Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Original NVD description (English source)
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS