Ivanti Endpoint Manager vulnerabilities
116 vulnerabilities
Known vulnerabilities in Ivanti Endpoint Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-13662ivantiendpoint_manager
EPSS score0.58%
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.CVE-2025-13661ivantiendpoint_managerEPSS score1.36%
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.CVE-2025-13659ivantiendpoint_managerEPSS score1.96%
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.CVE-2025-62388ivantiendpoint_managerEPSS score0.82%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62389ivantiendpoint_managerEPSS score1.74%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62384ivantiendpoint_managerEPSS score0.83%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62387ivantiendpoint_managerEPSS score1.73%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62390ivantiendpoint_managerEPSS score1.74%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62392ivantiendpoint_managerEPSS score0.82%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62386ivantiendpoint_managerEPSS score0.82%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62385ivantiendpoint_managerEPSS score0.82%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62391ivantiendpoint_managerEPSS score0.82%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-62383ivantiendpoint_managerEPSS score0.83%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-11622ivantiendpoint_managerEPSS score0.78%
Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.CVE-2025-11623ivantiendpoint_managerEPSS score0.83%
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.CVE-2025-9712ivantiendpoint_managerEPSS score23.86%
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.CVE-2025-9872ivantiendpoint_managerEPSS score15.79%
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.CVE-2025-9713ivantiendpoint_managerEPSS score15.33%
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.CVE-2025-7037ivantiendpoint_managerEPSS score0.95%
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the databaseCVE-2025-22458ivantiendpoint_managerEPSS score0.40%
DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.