Ivanti products RCE via filename validation flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple Ivanti products have critical remote code execution vulnerabilities; patching required immediately.
CIS-ISAC advisory 2025-084 documents multiple vulnerabilities across Ivanti's endpoint and access management product line. The most severe are insufficient filename validation flaws in Ivanti Endpoint Manager (CVE-2025-9712, CVE-2025-9872) that allow unauthenticated remote code execution with user interaction. These affect Endpoint Manager 2022 SU8 Security Update 1 and prior, and 2024 SU3 and prior. Ivanti reports no known exploitation at time of disclosure.
Additional lower-severity vulnerabilities span Ivanti Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access, including missing authorization checks that allow privilege escalation by authenticated read-only admins, CSRF attacks requiring user interaction, HTML5 connection hijacking, denial of service, SSRF for internal service enumeration, and reflected text injection. Most of these vulnerabilities affecting the 22.7/22.8 product lines were patched on 2 August 2025. Defenders must prioritize patching Endpoint Manager immediately given the RCE risk, then apply fixes for the remaining products across their infrastructure.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-084
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs