Introduction
A path traversal flaw in Ivanti Endpoint Manager lets remote attackers achieve remote code execution and, if user interaction is present, potentially compromise the entire managed environment. The vulnerability is tracked as CVE-2025-9713 and rated 8.8 on the CVSS scale. It affects a core enterprise management platform used across critical sectors including healthcare, finance, and government.
Ivanti Endpoint Manager is a unified endpoint management product that provides centralized control and automation for Windows, Mac, Linux, and mobile devices. Because it is so widely deployed, any vulnerability in it carries more weight than usual, and a compromise can put a whole organization at risk.
Technical information
CVE-2025-9713 is a path traversal vulnerability classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Ivanti Endpoint Manager does not sufficiently validate user-supplied path input during file system operations. Attackers can exploit this by crafting HTTP requests that contain directory traversal sequences such as ../, which let them escape the intended directories and manipulate file operations.
An attacker who exploits the flaw can place or execute arbitrary files outside authorized locations, which leads to remote code execution. The attack requires user interaction, typically convincing a user to visit a malicious page or open a crafted file. An attacker who obtains administrative credentials may be able to bypass the user interaction requirement, which raises the risk.
No public code snippets or detailed proof of concept have been released for this vulnerability. Vendor advisories and third-party research document the technical details and confirm that the mechanism is improper path validation leading to unauthorized file system access.
Affected systems and versions
- Ivanti Endpoint Manager versions prior to 2024 SU3
- Ivanti Endpoint Manager versions prior to 2022 SU8
Systems running these versions are vulnerable if the affected file handling functionality is exposed and user interaction occurs. Teams should evaluate both internet-exposed and internally managed deployments for risk.
Vendor security history
Ivanti has dealt with a series of critical vulnerabilities in its endpoint management and secure access products throughout 2024 and 2025. Notable incidents include:
- Multiple zero-day vulnerabilities disclosed by the Zero Day Initiative in October 2025
- Prior active exploitation of Ivanti Connect Secure and Policy Secure vulnerabilities by advanced threat actors
- Patch response timelines that have sometimes stretched for months and drawn scrutiny from the security research community
Ivanti releases patches on a monthly cycle but has struggled to fix complex vulnerabilities quickly.
