High

Remote Code Execution via Path Traversal in Ivanti Endpoint Manager

IdentifiersCVE-2025-9713CWE-22· Improper Limitation of a Pathname…

CVE-2025-9713 is a path traversal vulnerability in Ivanti Endpoint Manager (EPM) that can lead to remote code execution. The flaw is reported to exist in the implementation of the OnSaveToDB method, where a user-supplied path is not properly validated before being used in file operations. By supplying crafted path traversal sequences, an attacker can escape intended directories and cause unauthorized file placement or execution outside restricted locations. The issue affects Ivanti Endpoint Manager versions before 2024 SU4; supporting content also more specifically references affected builds including 2024 SU3 SR1 and prior, and 2022 SU8 SR2 and prior. Under normal conditions exploitation requires user interaction.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote unauthenticated attacker to achieve remote code execution in the context of the current user. Because Ivanti Endpoint Manager is a centralized endpoint management platform, compromise can have broad downstream impact, including unauthorized file write or execution, loss of confidentiality, integrity, and availability, and potential compromise of the wider managed environment.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, reduce exposure of Ivanti Endpoint Manager services to untrusted networks, restrict access to administrative and web interfaces, enforce least privilege, and monitor for suspicious file operations or crafted requests containing traversal sequences such as ../. Because exploitation normally requires user interaction, reduce risk through user-awareness controls around malicious pages and files. Additional defensive measures referenced in the supporting content include vulnerability scanning, network segmentation, exploit protection, and penetration testing.

Remediation

Patch, then assume compromise.

Upgrade Ivanti Endpoint Manager to a fixed release. The provided content indicates Ivanti published a fix on 2025-11-12 and that all versions before 2024 SU4 are affected. Where applicable, prioritize remediation for deployments identified as 2024 SU3 SR1 and prior or 2022 SU8 SR2 and prior. Validate that the November 2025 security update or a later supported release has been fully applied across all EPM servers.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

IvantiEndpoint Managerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cisecurity blog msisca and eiisacNews

Oct 14, 2025

Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution

A path traversal vulnerability in Ivanti Endpoint Manager that can allow remote unauthenticated code execution with user interaction.

zeropath blogNews

Oct 13, 2025

Ivanti Endpoint Manager CVE-2025-9713 Path Traversal RCE - Brief Summary and Technical Details - ZeroPath Blog | ZeroPath

A path traversal vulnerability in Ivanti Endpoint Manager that can lead to remote code execution through improper validation of user-supplied path input during file system operations.

security weekNews

May 31, 2026

High-Severity Vulnerabilities Patched by Ivanti and Zoom

A vulnerability in Ivanti Endpoint Manager (EMP), described as one of the previously disclosed flaws and characterized as either a path traversal or insecure deserialization issue, that could be abused by unauthenticated attackers for remote code execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2025-9713

NVD

nvd.nist.gov/vuln/detail/CVE-2025-9713

MITRE CWE · CWE-22

Improper Limitation of a Pathname to a…

Vendor Advisory

forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025