CVE-2025-10573

Severity

CRITICAL

CVSS

9.6

EPSS

0.33499

Risk score

50.12

CISA KEV

PoC

Published

2025-12-09

Modified

2026-02-26

First seen

2026-08-07

Aliases

CNVD-2026-02910, EUVD-2025-202300, GHSA-VC8Q-W37R-FMJC

Products

Ivanti Ivanti Endpoint Manager <2024 SU4 SR1, Ivanti:Endpoint Manager patch: 2024 SU4 SR1

Sources

cnvd CNVD-2026-02910
euvd EUVD-2025-202300

Description

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

References

https://www.cnvd.org.cn/flaw/show/CNVD-2026-02910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10573
https://nvd.nist.gov/vuln/detail/CVE-2025-10573
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202300
https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024