A severe vulnerability in Ivanti Endpoint Manager (EPM) versions 2024 SU4 and earlier allows unauthenticated threat actors to inject malicious JavaScript payloads into the administrator web dashboard, ultimately gaining complete control of admin sessions.
Tracked as CVE-2025-10573 with a CVSS score of 9.6, the flaw was patched on December 9, 2025, with the release of Ivanti EPM 2024 SU4 SR1.
Ivanti EPM is widely deployed across enterprises for remote endpoint administration, vulnerability scanning, and compliance management.
The vulnerability’s unauthenticated nature makes it particularly dangerous, as attackers need no credentials to attack vulnerable instances.
Attack Mechanism and Technical Details
The vulnerability exists within Ivanti EPM’s ‘incomingdata’ web API, which processes device scan data without proper authentication checks.
Researchers found that the API invokes a CGI binary, postcgi.exe, which writes device-scan files to a processing directory.
An unauthenticated attacker can submit malicious device scan data containing JavaScript injection payloads in various fields, such as Device ID, Display Name, or OS Name.
When administrators access web dashboard pages that display device information, the XSS payloads are executed in their browser context.
This passive interaction triggers the malicious JavaScript, allowing attackers to seize control of the administrator’s session and perform actions with full administrative privileges, including remote endpoint control and software installation.
Rapid7 staff researcher Ryan Emmons identified the vulnerability during analysis of Ivanti EPM 11.0.6 Core on Windows Server 2022. The flaw affects all versions below EPM 2024 SU4 SR1.
Organizations using vulnerable Ivanti EPM versions should prioritize patching affected instances immediately.
The vendor recommends upgrading to Ivanti EPM version 2024 SU4 SR1 to resolve the vulnerability.
Rapid7 customers using Exposure Command, InsightVM, and Nexpose will receive authenticated vulnerability checks in the December 9, 2025, content release.
Given the ease of exploitation and the severity of potential compromise, security teams should treat this vulnerability as critical and expedite patching across all affected EPM deployments.
| CVE Details | |
|---|---|
| CVE ID | CVE-2025-10573 |
| Product | Ivanti Endpoint Manager |
| Affected Versions | EPM 2024 SU4 and earlier |
| Vulnerability Type | Stored Cross-Site Scripting (XSS) |
| CVSS Score | 9.6 (Critical) |
| Authentication Required | No |
| Attack Complexity | Low |
| Fixed Version | EPM 2024 SU4 SR1 |
| Patch Release Date | December 9, 2025 |
| Discoverer | Ryan Emmons, Rapid7 |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Update
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2025-10573 with a CVSS score of 9.6, the flaw was patched on December 9, 2025, with the release of Ivanti EPM 2024 SU4 SR1.){kind=link}