CVE-2025-13661: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

CVE-2025-13661 is a path traversal vulnerability (CWE-22) in Ivanti Endpoint Manager (EPM) that allows a remote authenticated attacker to write arbitrary files outside of the intended directory. It affects all EPM 2024 versions prior to 2024 SU4 SR1, including 2024, 2024 SU1, SU2, SU3, SU3 SR1, and SU4. The vulnerability was published on December 9, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 8.0 (High), though ENISA scores it at 7.1 (High) (Ivanti Advisory, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). An authenticated remote attacker can craft a malicious request that causes the EPM server to write files to arbitrary locations outside the intended directory boundary, bypassing path validation controls. Exploitation requires user interaction, suggesting the attack may involve a social engineering component or a triggered server-side action initiated by a victim user. Related attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-76 (Manipulating Web Input to File System Calls) (Feedly, ZDI Advisory).

Successful exploitation allows an attacker with low-privilege authenticated access to write arbitrary files to unauthorized locations on the EPM server, potentially placing malicious files in critical system directories. This can lead to high confidentiality and integrity impacts — including unauthorized code execution, modification of system configurations, or exposure of sensitive data — as well as high availability impact if critical system files are overwritten or corrupted. The affected asset is the Ivanti EPM server, which typically manages endpoints across an enterprise, making compromise of this system a significant risk for lateral movement (Feedly, Ivanti Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.406%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 386197) and Nessus (ID: 278330) (Qualys, Tenable).

Ivanti has released a patch in EPM version 2024 SU4 SR1, which resolves this vulnerability. Organizations should upgrade to this version immediately. As interim measures, administrators should implement strict access controls on the EPM management interface, apply network segmentation to limit access to EPM servers, enforce least-privilege principles for EPM users, and monitor for unauthorized file write activity on the EPM server (Ivanti Advisory, Feedly).

The vulnerability was covered as part of Ivanti's December 2025 security advisory, which addressed multiple EPM flaws and received broad coverage from security media outlets including The Hacker News, GBHackers, Heise, and CyberSecurityNews (The Hacker News, GBHackers, Heise). The Belgian Centre for Cybersecurity (CCB) issued a warning urging organizations to patch, and SecurityOnline highlighted the broader EPM advisory including risks of admin session hijack and unauthenticated RCE from related CVEs (CCB Belgium, SecurityOnline). Community sentiment reflects urgency given Ivanti's history of exploited vulnerabilities, though this specific CVE has not yet been weaponized.