CVE-2025-9872

What it is

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

16.7% chance of exploitation in the next 30 days (EPSS). Higher than most.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-09-09 16:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-26 00:10 UTC Last updatedMost recent change to the record

Details

Published

2025-09-09 16:15 UTC

Last modified

2026-09-26 00:10 UTC

Exploit probability

16.7% · EPSS, next 30 days

Weakness

CWE-434 · Unrestricted file upload

Record status

Analyzed

Affected

• Ivanti Endpoint Manager < 2022
• Ivanti Endpoint Manager 2022
• Ivanti Endpoint Manager 2024

Attack profile CVSS 3.1 · 8.8

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High