CVE-2025-13661: Ivanti Endpoint Manager

High severity, CVSS 8.0. EPSS: 1.4% chance of exploitation in the next 30 days.

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.

Affected products

• Ivanti Endpoint Manager: before 2024 (fixed in 2024); version 2024 only

Published 2025-12-09. Last modified 2026-10-07.