Ivanti Security Updates – 09 July 2025

The addressed vulnerabilities could allow the attacker to trigger denial of service attacks, perform server-side request forgery attacks, conduct carriage return line feed injection attacks, obtain sensitive information, or execute arbitrary code and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. Ivanti Endpoint Manager Improper Encryption Implementation Vulnerability(CVE-2025-6995):

• CVSS: 8.4
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Obtain Information

2. Ivanti Endpoint Manager Mobile (EPMM) OS Command Injection Vulnerability (CVE-2025-6770):

• CVSS: 7.2
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Gain Access

Affected Products:

• Ivanti Connect Secure.
• Ivanti Policy Secure.
• Ivanti Endpoint Manager Mobile.
• Ivanti Endpoint Manager.