Ivanti Endpoint Manager and EPMM RCE vulnerabilities disclosed

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Multiple Ivanti management products have path traversal, command injection, and SQL injection vulnerabilities allowing remote code execution; no in-the-wild exploitation reported.

CIS has published MS-ISAC Advisory 2025-095 documenting multiple vulnerabilities across three Ivanti product lines: Endpoint Manager, Endpoint Manager Mobile (EPMM), and Neurons for Mobile Device Management. The most critical flaw is a path traversal vulnerability in Ivanti Endpoint Manager (CVE-2025-9713) that allows unauthenticated remote attackers to achieve code execution with user interaction required. Additional vulnerabilities include OS command injection in EPMM admin panels (CVE-2025-10242, CVE-2025-10243, CVE-2025-10985), missing authorization and MFA bypass in Neurons for MDM, unauthenticated API access to sensitive data, path traversal for disk writes, insecure deserialization for privilege escalation, and multiple SQL injection flaws in Endpoint Manager allowing unauthorized database reads. The advisory confirms no active exploitation has been observed in the wild as of publication. Affected versions range from Ivanti Endpoint Manager 2024 SU3 SR1 and earlier, EPMM versions 12.6.0.1 and prior, and Neurons for MDM R118 and prior. The impact of successful exploitation depends on system privileges, but could allow program installation, data modification, and deletion.

title: Java Process Spawning Shell With Download or Reverse-Shell Arguments on Linux
description: Detects a java parent process (such as the Tomcat service behind web
  admin panels like Ivanti EPMM) spawning sh/bash with download-and-execute or reverse-shell
  arguments. This pattern is typical of post-exploitation after OS command injection
  in a public-facing Java application. The pattern is generic and not specific to
  one CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - mkfifo
    - chmod +x
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java-based build or deployment agents (e.g. Jenkins) running scripts that call curl
  or wget
- Legitimate application update scripts launched from the Java service
level: medium
id: 13c333ec-93df-52a5-95a5-222e1401b257
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095

title: Ivanti Endpoint Manager Process Spawning Command Interpreter
description: Detects processes executing from Ivanti or LANDesk Endpoint Manager install
  directories that spawn cmd.exe, PowerShell or common download LOLBins. Server-side
  exploitation of path traversal or injection flaws in Endpoint Manager may lead to
  such child processes. Generalises on the parent/child relation, not on any specific
  payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \LANDesk\
    - \Ivanti\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
  filter_scripted_admin:
    CommandLine|contains: LANDesk\ManagementSuite\scripts
  condition: selection_parent and selection_child and not filter_scripted_admin
falsepositives:
- Ivanti Endpoint Manager built-in maintenance or patching scripts that invoke cmd
  or PowerShell
- Administrators running custom software distribution tasks through the EPM agent
level: medium
id: de7aa834-24e6-549f-84be-bcf88f81a051
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095