Loading story…
Ivanti disclosed and patched multiple vulnerabilities in Endpoint Manager (EPM), led by CVE-2024-29847, a critical unauthenticated remote code execution flaw in the Agent Portal service affecting versions prior to EPM 2022 SU6 and the 2024 September update. Ivanti rated the deserialization bug CVSS 10.0 and said it could let remote attackers execute code without authentication; the September advisory also listed additional weaknesses including XXE, multiple SQL injection flaws that could lead to RCE, authentication issues in Network Isolation and Patch Management, API secret exposure, spoofing of isolation status, and a local privilege escalation bug in the EPM agent.
Technical analysis of CVE-2024-29847 said the vulnerable Agentportal.exe service exposed a .NET Remoting TCP endpoint with a dynamically assigned port and no transport security, allowing insecure deserialization against the LANDesk.AgentPortal.IAgentPortal interface. The researcher reported that exploitation remained possible even with the .NET Remoting type filter set to Low, adapting prior techniques to bypass remoting restrictions, gain code execution, and write an ASP.NET web shell into a public IIS application directory; the writeup further claimed the compromise could be escalated from the IIS application pool context to NT AUTHORITY\SYSTEM by abusing leaked token handles in the worker process.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A public technical writeup described how the Ivanti EPM Agent Portal .NET Remoting flaw could be exploited pre-authentication for remote code execution, including bypass techniques for the Low Type Filter and web-shell deployment details.
Ivanti published a security advisory covering multiple Endpoint Manager vulnerabilities, including CVE-2024-29847, a critical unauthenticated deserialization RCE in the Agent Portal affecting versions before 2022 SU6 or the 2024 September update.
The researcher says they reported the Ivanti Endpoint Manager Agent Portal deserialization vulnerability, later tracked as CVE-2024-29847, to Ivanti on May 1, 2024.
A researcher writeup states Ivanti later published its advisory for the patched Ivanti EPM vulnerability on September 11, 2024, identifying it as a critical CVSS 10.0 issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
summoning.team
Open sourceforums.ivanti.com
Open sourcesummoning.team
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti has disclosed a critical vulnerability (CVE-2025-10573) in its Endpoint Manager (EPM) software, which allows unauthenticated remote attackers to execute arbitrary JavaScript code via a stored cross-site scripting (XSS) attack. The flaw enables attackers to register fake managed endpoints to the EPM server, thereby injecting malicious JavaScript into the administrator web dashboard. When an administrator interacts with the compromised dashboard, the attacker can hijack the session and potentially gain full control over the EPM environment. Ivanti has released a patch (EPM 2024 SU4 SR1) to address this issue and strongly urges customers to update, especially since hundreds of EPM instances are exposed to the internet, increasing the risk of exploitation. The vulnerability, assigned a CVSS score of 9.6, affects EPM versions 2024 SU4 and below. Security researchers at Rapid7, who discovered and reported the flaw, emphasize the urgency of patching due to the unauthenticated nature of the attack vector. Ivanti EPM is widely used for endpoint management, remote administration, and compliance, making it a high-value target for attackers. In addition to CVE-2025-10573, Ivanti has also released fixes for three other high-severity vulnerabilities in the same update cycle. Security teams are advised to apply the latest patches immediately and review the exposure of EPM instances to the internet to mitigate the risk of compromise.
Jun 29, 2026
Ivanti warned that its on-premises **Endpoint Manager Mobile (EPMM)** product contains two critical vulnerabilities, **`CVE-2026-1281`** and **`CVE-2026-1340`**, that can let an unauthenticated remote attacker execute arbitrary commands or code over the network. The flaws affect exposed EPMM servers and create a path to full server compromise and possible lateral movement into internal environments. Ivanti said its cloud offerings, including **Ivanti Neurons for MDM**, and the separate **Ivanti Endpoint Manager (EPM)** product are not affected, and it released patches, incident-response guidance, and a detection tool to help customers assess exposure and compromise. Follow-up advisories said the vulnerabilities are being **actively exploited**, prompting defenders to inspect EPMM systems for anomalous logs, unauthorized administrator-account changes, and suspicious device-configuration modifications. A later update citing Germany's **BSI** said exploitation may date back to **summer 2025**, expanding the scope of required forensic review beyond recent activity. Public reporting from security researchers, including Palo Alto Networks Unit 42 and vulnerability tracking sources, reinforced that the issue is an unauthenticated remote code execution risk requiring immediate patching and retrospective compromise hunting on affected on-premises deployments.
Jun 29, 2026
Ivanti Endpoint Manager has been found to contain several critical vulnerabilities that could allow remote code execution (RCE) by attackers. The Zero Day Initiative (ZDI) disclosed thirteen vulnerabilities affecting undisclosed versions of Ivanti Endpoint Manager, with several remaining unpatched at the time of disclosure. Among these, ZDI-25-935 is particularly severe, enabling a remote, unauthenticated attacker to achieve RCE if they can trick a user into visiting a malicious webpage or opening a malicious file. Alternatively, attackers with administrative credentials can exploit this vulnerability without user interaction. This flaw arises from improper validation of user-supplied paths in the OnSaveToDB method, resulting in a path traversal vulnerability. Another significant vulnerability, ZDI-25-952 (CVE-2025-9872), involves the UniqueFilename attribute, where insufficient validation allows unrestricted file uploads. Exploitation of this flaw enables attackers to execute arbitrary code in the context of the NETWORK SERVICE account, again requiring either user interaction or administrative credentials. The CVSS score for these vulnerabilities is high, with ZDI-25-935 and ZDI-25-952 both rated at 8.8, indicating a critical risk to organizations using affected versions of Ivanti Endpoint Manager. Additional vulnerabilities, such as ZDI-25-936 and ZDI-25-947, involve SQL injection and privilege escalation, further increasing the attack surface. The SQL injection vulnerabilities stem from improper validation of user-supplied strings in the Report_Run and Report_Run2 classes, allowing attackers to execute code as the service account. Ivanti has responded by issuing updates to address at least some of these vulnerabilities, specifically releasing a patch for CVE-2025-9872. The vulnerabilities were reported to Ivanti in June 2025, with coordinated public disclosure occurring in October 2025. Attackers exploiting these flaws could gain significant control over affected systems, potentially leading to data theft, lateral movement, or disruption of endpoint management operations. Organizations are strongly advised to identify Ivanti Endpoint Manager installations within their networks and apply the latest security updates as soon as possible. The vulnerabilities highlight the importance of robust input validation and secure file handling in enterprise software. Security teams should also review user privileges and monitor for suspicious activity related to file uploads or unusual database queries. Given the critical nature of these vulnerabilities and the potential for exploitation, prompt remediation and heightened vigilance are essential for organizations relying on Ivanti Endpoint Manager.
Jul 12, 2026