# Ivanti products RCE via filename validation flaws

Published: 2026-06-09 · Severity: elevated · Sectors: government-national, financial-services, healthcare, defense, technology, manufacturing
Canonical: https://vorant.io/reports/fd4daa48-d2e5-5aa4-9622-b3b3a2a7bf38/ivanti-products-rce-via-filename-validation-flaws

> Multiple Ivanti products have critical remote code execution vulnerabilities; patching required immediately.

CIS-ISAC advisory 2025-084 documents multiple vulnerabilities across Ivanti's endpoint and access management product line. The most severe are insufficient filename validation flaws in Ivanti Endpoint Manager (CVE-2025-9712, CVE-2025-9872) that allow unauthenticated remote code execution with user interaction. These affect Endpoint Manager 2022 SU8 Security Update 1 and prior, and 2024 SU3 and prior. Ivanti reports no known exploitation at time of disclosure.

Additional lower-severity vulnerabilities span Ivanti Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access, including missing authorization checks that allow privilege escalation by authenticated read-only admins, CSRF attacks requiring user interaction, HTML5 connection hijacking, denial of service, SSRF for internal service enumeration, and reflected text injection. Most of these vulnerabilities affecting the 22.7/22.8 product lines were patched on 2 August 2025. Defenders must prioritize patching Endpoint Manager immediately given the RCE risk, then apply fixes for the remaining products across their infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2025-55139, CVE-2025-55141, CVE-2025-55142, CVE-2025-55143, CVE-2025-55144, CVE-2025-55145, CVE-2025-55146, CVE-2025-55147, CVE-2025-55148, CVE-2025-8711, CVE-2025-8712, CVE-2025-9712, CVE-2025-9872

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-remote-code-execution_2025-084

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fd4daa48-d2e5-5aa4-9622-b3b3a2a7bf38/ivanti-products-rce-via-filename-validation-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup