# Ivanti Endpoint Manager RCE via multiple vulnerabilities

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/f321b13f-c218-5c3d-91da-839db80671e9/ivanti-endpoint-manager-rce-via-multiple-vulnerabilities

> Multiple vulnerabilities in Ivanti Endpoint Manager allow unauthenticated XSS and authenticated SQL injection to achieve remote code execution; no active exploitation reported.

Ivanti Endpoint Manager contains multiple vulnerabilities with a maximum severity of remote code execution. The most critical issues include reflected cross-site scripting (CVE-2025-22465, CVE-2025-22466) that allow unauthenticated remote attackers to execute arbitrary JavaScript or escalate to admin privileges with minimal user interaction, and SQL injection (CVE-2025-22461) requiring admin privileges to achieve code execution. An authenticated attacker can also perform DLL hijacking (CVE-2025-22458) to escalate to system-level privileges. Additional lower-severity issues include pointer dereference causing denial of service (CVE-2025-22464) and improper certificate validation (CVE-2025-22459) enabling traffic interception.

Affected versions include Ivanti Endpoint Manager 2022 SU6 and earlier, and 2024 prior to SU1. The advisory states there are currently no reports of these vulnerabilities being exploited in the wild. Defenders should prioritize applying patches for versions 2024 SU1 and 2022 SU7 or later, implement network segmentation, run services with least privilege, and maintain vulnerability scanning and patch management processes to mitigate exploitation risk.

## Mentioned in this report

- Vulnerabilities: CVE-2025-22458, CVE-2025-22459, CVE-2025-22461, CVE-2025-22464, CVE-2025-22465, CVE-2025-22466

## Detection guidance (public sample)

### SQL Server Spawning Command Shell or Scripting Interpreter

ATT&CK: T1059

sqlservr.exe spawning cmd/PowerShell/script hosts, consistent with SQL injection escalating to OS command execution (xp_cmdshell) on an Ivanti EPM core database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Server Spawning Command Shell or Scripting Interpreter
id: 4df2206b-9198-54ab-b455-362d91a1626b
status: experimental
description: Detects sqlservr.exe spawning a shell or scripting interpreter. After
  SQL injection such as CVE-2025-22461 against Ivanti Endpoint Manager, an attacker
  can reach OS command execution through xp_cmdshell or similar. Generalises on the
  parent/child relation, not on specific commands.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- DBA maintenance jobs or backup scripts that intentionally call xp_cmdshell
- Legacy SQL Agent job steps that run cmd.exe batch files
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
```

### IIS Worker Process Spawning Shell on Web Management Server

ATT&CK: T1190

w3wp.exe spawning cmd/PowerShell/LOLBins, indicating code execution through a web-facing management console such as Ivanti EPM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell on Web Management Server
id: 0318ed71-463d-58c8-9123-8d4ba22f63f6
status: experimental
description: Detects the IIS worker process w3wp.exe spawning shells or LOLBins. Web-console
  exploitation such as the Ivanti Endpoint Manager XSS/SQLi chain leading to RCE would
  show this parent/child pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Web applications that legitimately shell out to cmd.exe for maintenance tasks
- Administrative web tools that invoke PowerShell
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
```

### Ivanti or LANDesk Process Loading DLL from User-Writable Path

ATT&CK: T1574.001

A process running from an Ivanti/LANDesk install directory loads a DLL from a user-writable location, consistent with DLL hijacking for privilege escalation such as CVE-2025-22458. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ivanti or LANDesk Process Loading DLL from User-Writable Path
id: e4a88015-26bc-5601-97d6-45247c9c4c46
status: experimental
description: Detects Ivanti/LANDesk agent or service binaries loading DLLs from user-writable
  directories (Users, ProgramData, Temp). This pattern matches DLL hijacking used
  for local privilege escalation, as in CVE-2025-22458.
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_proc:
    Image|contains:
    - \LANDesk\
    - \Ivanti\
  selection_dll:
    ImageLoaded|contains:
    - \Users\
    - \ProgramData\
    - \Windows\Temp\
    - \AppData\
  filter_ivanti_programdata:
    ImageLoaded|contains:
    - \ProgramData\LANDesk\
    - \ProgramData\Ivanti\
  condition: selection_proc and selection_dll and not filter_ivanti_programdata
falsepositives:
- Ivanti agent components that stage their own signed DLLs in a user profile during
  updates
- Software distribution packages executed from a temp directory by the Ivanti agent
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-remote-code-execution_2025-037

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f321b13f-c218-5c3d-91da-839db80671e9/ivanti-endpoint-manager-rce-via-multiple-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup