VulnerabilityhighExploited in the wild

Ivanti warns customers of new EPM flaw enabling remote code execution

Security Affairsby @securityaffairsDec 9, 2025 · 22:11 UTC (Dec 9, 2025)2 min read2

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-10573 CVE-2024-13159 CVE-2024-13160 CVE-2024-13161

Tags: cve-2025-10573 cve-2024-13159 cve-2024-13160 cve-2024-13161 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-13159 +2 related CVEs CVE-2024-13160 CVE-2024-13161	Unauthenticated Absolute Path Traversal Info Leak in Ivanti Endpoint Manager (EPM)	7.5	100%	KEVPoC	Jan 14, 2025 KEV Mar 10, 2025
CVE-2025-10573	Stored Cross-Site Scripting in Ivanti Endpoint Manager Exposes Admin Sessions	6.1	33%		Dec 9, 2025

From the original article

2 min read at securityaffairs.com

Ivanti warns users to address a newly disclosed Endpoint Manager vulnerability that could let attackers execute code remotely. Software firm Ivanti addressed a newly disclosed vulnerability, tracked as CVE-2025-10573 (CVSS score 9. 6), in its Endpoint Manager (EPM) solution.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.