PT-2025-46347 · Ivanti · Ivanti Endpoint Manager
CVE-2025-10918
·
Published
2025-11-11
·
Updated
2025-11-12
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ivanti Endpoint Manager versions prior to 2024 SU4
Description
A security issue exists in the agent component of Ivanti Endpoint Manager that allows a locally authenticated attacker to write arbitrary files to any location on the disk due to insecure default permissions. This can be used as a privilege escalation method.
Recommendations
Update Ivanti Endpoint Manager to version 2024 SU4 or later.
Fix
LPE
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ivanti Endpoint Manager