Paper/Archive/CVE-2025-10573

CVE-2025-10573

Ivanti Endpoint Manager — Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScr…

EPSS 33%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 98.4.984 × 2019.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Affected

ProductAffectedFixed inSource

Endpoint Managersee advisory2024 SU4 SR1CNA

Scores by source

ivanti (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024