Ivanti Endpoint Manager RCE via multiple vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Ivanti Endpoint Manager allow unauthenticated XSS and authenticated SQL injection to achieve remote code execution; no active exploitation reported.
Ivanti Endpoint Manager contains multiple vulnerabilities with a maximum severity of remote code execution. The most critical issues include reflected cross-site scripting (CVE-2025-22465, CVE-2025-22466) that allow unauthenticated remote attackers to execute arbitrary JavaScript or escalate to admin privileges with minimal user interaction, and SQL injection (CVE-2025-22461) requiring admin privileges to achieve code execution. An authenticated attacker can also perform DLL hijacking (CVE-2025-22458) to escalate to system-level privileges. Additional lower-severity issues include pointer dereference causing denial of service (CVE-2025-22464) and improper certificate validation (CVE-2025-22459) enabling traffic interception.
Affected versions include Ivanti Endpoint Manager 2022 SU6 and earlier, and 2024 prior to SU1. The advisory states there are currently no reports of these vulnerabilities being exploited in the wild. Defenders should prioritize applying patches for versions 2024 SU1 and 2022 SU7 or later, implement network segmentation, run services with least privilege, and maintain vulnerability scanning and patch management processes to mitigate exploitation risk.
Mentioned in this report
Detection guidance
SQL Server Spawning Command Shell or Scripting Interpreter
sqlservr.exe spawning cmd/PowerShell/script hosts, consistent with SQL injection escalating to OS command execution (xp_cmdshell) on an Ivanti EPM core database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Spawning Command Shell or Scripting Interpreter
id: 4df2206b-9198-54ab-b455-362d91a1626b
status: experimental
description: Detects sqlservr.exe spawning a shell or scripting interpreter. After
SQL injection such as CVE-2025-22461 against Ivanti Endpoint Manager, an attacker
can reach OS command execution through xp_cmdshell or similar. Generalises on the
parent/child relation, not on specific commands.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sqlservr.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- DBA maintenance jobs or backup scripts that intentionally call xp_cmdshell
- Legacy SQL Agent job steps that run cmd.exe batch files
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
IIS Worker Process Spawning Shell on Web Management Server
w3wp.exe spawning cmd/PowerShell/LOLBins, indicating code execution through a web-facing management console such as Ivanti EPM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Shell on Web Management Server
id: 0318ed71-463d-58c8-9123-8d4ba22f63f6
status: experimental
description: Detects the IIS worker process w3wp.exe spawning shells or LOLBins. Web-console
exploitation such as the Ivanti Endpoint Manager XSS/SQLi chain leading to RCE would
show this parent/child pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Web applications that legitimately shell out to cmd.exe for maintenance tasks
- Administrative web tools that invoke PowerShell
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
Ivanti or LANDesk Process Loading DLL from User-Writable Path
A process running from an Ivanti/LANDesk install directory loads a DLL from a user-writable location, consistent with DLL hijacking for privilege escalation such as CVE-2025-22458. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti or LANDesk Process Loading DLL from User-Writable Path
id: e4a88015-26bc-5601-97d6-45247c9c4c46
status: experimental
description: Detects Ivanti/LANDesk agent or service binaries loading DLLs from user-writable
directories (Users, ProgramData, Temp). This pattern matches DLL hijacking used
for local privilege escalation, as in CVE-2025-22458.
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection_proc:
Image|contains:
- \LANDesk\
- \Ivanti\
selection_dll:
ImageLoaded|contains:
- \Users\
- \ProgramData\
- \Windows\Temp\
- \AppData\
filter_ivanti_programdata:
ImageLoaded|contains:
- \ProgramData\LANDesk\
- \ProgramData\Ivanti\
condition: selection_proc and selection_dll and not filter_ivanti_programdata
falsepositives:
- Ivanti agent components that stage their own signed DLLs in a user profile during
updates
- Software distribution packages executed from a temp directory by the Ivanti agent
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs