Introduction
Remote code execution in an enterprise endpoint management system can give attackers privileged access to thousands of managed devices. CVE-2025-9872 is a recent example. It lets unauthenticated attackers exploit filename validation flaws in Ivanti Endpoint Manager, and the impact could be wide-reaching on installations that stay unpatched.
Ivanti Endpoint Manager is a widely deployed platform for centralized device management, patching, and policy enforcement across enterprise environments. Its customers span multiple industries and include organizations with large-scale IT infrastructure. A security flaw in this product directly affects their operational security and regulatory compliance.
Technical Information
CVE-2025-9872 is caused by insufficient filename validation in Ivanti Endpoint Manager. It is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). An attacker can submit a file with a crafted name or extension that bypasses the application's security controls. If a legitimate user then interacts with the malicious file, for example by uploading or opening it, the attacker can execute code remotely on the server.
Key technical points:
- Remote unauthenticated attackers can execute arbitrary code
- Exploitation requires user interaction
- The flaw is in file upload or processing functionality, where filename or file type validation is inadequate
- No public code snippets or exploit samples are available
Patch Information
Ivanti has fixed CVE-2025-9872, along with the related CVE-2025-9712, in the following updates:
- Ivanti Endpoint Manager 2022 SU8 Security Update 2
- Ivanti Endpoint Manager 2024 SU3 Security Update 1
These updates strengthen filename validation and prevent unauthorized code execution. Organizations running affected versions should apply them immediately.
References:
Affected Systems and Versions
- Ivanti Endpoint Manager versions prior to 2024 SU3 Security Update 1
- Ivanti Endpoint Manager versions prior to 2022 SU8 Security Update 2
Any installation that has not been updated to at least these versions is vulnerable. The flaw affects both the current and the legacy branches.
Vendor Security History
Ivanti has had several high-severity vulnerabilities in its product line, including multiple RCE flaws in Endpoint Manager and Endpoint Manager Mobile, and credential theft vulnerabilities. Advanced threat actors, including nation-state groups, have exploited some of them.
Ivanti typically issues patches promptly and publishes advisories. Similar issues keep recurring, though, which points to ongoing problems in its secure development and testing processes.
