Home

Description

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

PUBLISHED Reserved 2025-09-02 | Published 2025-09-09 | Updated 2025-09-10 | Assigner ivanti




HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
affected

2024 SU3 Security Release 1 (custom)
unaffected

2022 SU8 Security Release 2 (custom)
unaffected

References

forums.ivanti.com/...or-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8

cve.org (CVE-2025-9872)

nvd.nist.gov (CVE-2025-9872)

Download JSON