CVE-2025-10918

Description

Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk

PUBLISHED Reserved 2025-09-24 | Published 2025-11-11 | Updated 2025-11-12 | Assigner ivanti

Problem types

CWE-276 Incorrect Default Permissions

Product status

References

forums.ivanti.com/...vember-2025-for-EPM-2024?language=en_US

cve.org (CVE-2025-10918)

nvd.nist.gov (CVE-2025-10918)

Download JSON