Introduction
Remote code execution in an enterprise management platform can lead to full compromise of business-critical infrastructure. CVE-2025-9712 is one such flaw in Ivanti Endpoint Manager, caused by insufficient filename validation. Exploiting it requires user interaction, and organizations still face significant risk from it.
Ivanti sells IT management and security software to enterprises, government agencies, and critical infrastructure sectors worldwide. Endpoint Manager is widely deployed for endpoint configuration, software distribution, and device management, so a flaw in it can affect both operations and data protection.
Technical information
CVE-2025-9712 comes from insufficient filename validation in Ivanti Endpoint Manager and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). A remote, unauthenticated attacker can upload a file with a crafted filename that evades the validation routines. If a user later interacts with that file through normal workflows or administrative interfaces, the attacker gains remote code execution.
The flaw is in the file upload mechanisms of versions prior to 2024 SU3 Security Update 1 and 2022 SU8 Security Update 2. The application does not check user-supplied filenames thoroughly, so files with executable extensions or embedded scripts may be stored and later executed by the application. No public code snippets or exploit code are available at this time.
An attacker who exploits the flaw can execute arbitrary code with the privileges of the application or service account. That can lead to full system compromise, lateral movement, and data exfiltration. The attack needs no authentication but does need user interaction, which makes targeted exploitation through social engineering or workflow manipulation more likely.
Patch information
Ivanti has fixed CVE-2025-9712 and the related CVE-2025-9872 in the following security updates:
- Ivanti Endpoint Manager 2022 SU8 Security Update 2
- Ivanti Endpoint Manager 2024 SU3 Security Update 1
Organizations running versions prior to these updates should upgrade immediately. The patched versions are available through Ivanti's official software download portal. No exploitation in the wild had been reported as of the disclosure date, but the severity of the issue still calls for prompt patching.
Reference: https://securityonline.info/ivanti-patches-two-high-severity-rce-flaws-in-endpoint-manager/
Affected systems and versions
- Ivanti Endpoint Manager versions prior to 2024 SU3 Security Update 1
- Ivanti Endpoint Manager versions prior to 2022 SU8 Security Update 2
Every configuration of an affected version is vulnerable. To mitigate the risk, update both the 2022 and 2024 product branches to the security update levels listed above.
Vendor security history
Ivanti has had multiple critical vulnerabilities across its product portfolio in 2025. CVE-2025-4427 and CVE-2025-4428 in Endpoint Manager Mobile involved authentication bypass and remote code execution, and were actively exploited in the wild. Other reported issues include credential coercion vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, CVE-2024-10811). Ivanti usually ships patches and advisories promptly, but severe flaws keep recurring, which points to ongoing challenges in secure software development and supply chain management.
