CVE-2025-10573 PUBLISHED

Assigner: ivanti
Reserved: 16.09.2025 Published: 09.12.2025 Updated: 26.02.2026

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS Score: 9.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Ivanti
Product	Endpoint Manager
Versions	Default: affected Version 2024 SU4 SR1 is unaffected

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CWE

Impacts

CAPEC-592 Stored XSS