# Ivanti Endpoint Manager and EPMM RCE vulnerabilities disclosed

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/65295bdc-bc6e-5a97-8bde-edfe81c72af0/ivanti-endpoint-manager-and-epmm-rce-vulnerabilities-disclosed

> Multiple Ivanti management products have path traversal, command injection, and SQL injection vulnerabilities allowing remote code execution; no in-the-wild exploitation reported.

CIS has published MS-ISAC Advisory 2025-095 documenting multiple vulnerabilities across three Ivanti product lines: Endpoint Manager, Endpoint Manager Mobile (EPMM), and Neurons for Mobile Device Management. The most critical flaw is a path traversal vulnerability in Ivanti Endpoint Manager (CVE-2025-9713) that allows unauthenticated remote attackers to achieve code execution with user interaction required. Additional vulnerabilities include OS command injection in EPMM admin panels (CVE-2025-10242, CVE-2025-10243, CVE-2025-10985), missing authorization and MFA bypass in Neurons for MDM, unauthenticated API access to sensitive data, path traversal for disk writes, insecure deserialization for privilege escalation, and multiple SQL injection flaws in Endpoint Manager allowing unauthorized database reads. The advisory confirms no active exploitation has been observed in the wild as of publication. Affected versions range from Ivanti Endpoint Manager 2024 SU3 SR1 and earlier, EPMM versions 12.6.0.1 and prior, and Neurons for MDM R118 and prior. The impact of successful exploitation depends on system privileges, but could allow program installation, data modification, and deletion.

## Mentioned in this report

- Vulnerabilities: CVE-2025-10242, CVE-2025-10243, CVE-2025-10985, CVE-2025-10986, CVE-2025-11622, CVE-2025-11623, CVE-2025-62383, CVE-2025-62384, CVE-2025-62385, CVE-2025-62386, CVE-2025-62387, CVE-2025-62388, CVE-2025-62389, CVE-2025-62390, CVE-2025-62391, CVE-2025-62392, CVE-2025-9713

## Detection guidance (public sample)

### Java Process Spawning Shell With Download or Reverse-Shell Arguments on Linux

ATT&CK: T1190

Java application server (e.g. Tomcat hosting an MDM admin panel) spawning a shell that runs download or reverse-shell commands, consistent with OS command injection in a public-facing appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell With Download or Reverse-Shell Arguments on Linux
description: Detects a java parent process (such as the Tomcat service behind web
  admin panels like Ivanti EPMM) spawning sh/bash with download-and-execute or reverse-shell
  arguments. This pattern is typical of post-exploitation after OS command injection
  in a public-facing Java application. The pattern is generic and not specific to
  one CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - mkfifo
    - chmod +x
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java-based build or deployment agents (e.g. Jenkins) running scripts that call curl
  or wget
- Legitimate application update scripts launched from the Java service
level: medium
id: 13c333ec-93df-52a5-95a5-222e1401b257
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095
```

### Ivanti Endpoint Manager Process Spawning Command Interpreter

ATT&CK: T1190

Processes running from Ivanti/LANDesk install paths on Windows spawning cmd, PowerShell or LOLBins, indicating possible code execution via exploitation of Endpoint Manager. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ivanti Endpoint Manager Process Spawning Command Interpreter
description: Detects processes executing from Ivanti or LANDesk Endpoint Manager install
  directories that spawn cmd.exe, PowerShell or common download LOLBins. Server-side
  exploitation of path traversal or injection flaws in Endpoint Manager may lead to
  such child processes. Generalises on the parent/child relation, not on any specific
  payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \LANDesk\
    - \Ivanti\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
  filter_scripted_admin:
    CommandLine|contains: LANDesk\ManagementSuite\scripts
  condition: selection_parent and selection_child and not filter_scripted_admin
falsepositives:
- Ivanti Endpoint Manager built-in maintenance or patching scripts that invoke cmd
  or PowerShell
- Administrators running custom software distribution tasks through the EPM agent
level: medium
id: de7aa834-24e6-549f-84be-bcf88f81a051
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-095

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/65295bdc-bc6e-5a97-8bde-edfe81c72af0/ivanti-endpoint-manager-and-epmm-rce-vulnerabilities-disclosed.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup