Ivanti Security Updates – 15 October 2025

The addressed vulnerabilities could allow the attacker to bypass security restrictions, gain elevated privileges, manipulate data, obtain sensitive information, or execute arbitrary code, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Ivanti Endpoint Manager Path Traversal Vulnerability (CVE-2025-9713):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Consequences: Obtain Information

2. Security Advisory Endpoint Manager Mobile (EPMM) Command Injection Vulnerability (CVE-2025-10242):

• CVSS: 7.2
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Gain Access

The Affected Products:

• Ivanti Endpoint Manager Mobile (EPMM) versions 12.6.0.1, 12.5.0.2, 12.4.0.3 and all prior.
• Ivanti Neurons for MDM R118 and prior.
• Ivanti Endpoint Manager versions 2022 SU8 SR2 and prior.
• Ivanti Endpoint Manager versions 2024 SU3 SR1 and prior.