CVE-2025-13659: ivanti endpoint_manager

Vulnerability summary

CVE-2025-13659 is a high (CVSS 8.8) vulnerability in ivanti endpoint_manager. EPSS estimates a 1.96% chance of exploitation in the next 30 days, higher than 80% of scored vulnerabilities.

Timeline

1. 09-12-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.

• CWE-913Improper Control of Dynamically-Managed Code ResourcesThe product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.