CVE-2025-6996CWE-257

Improper Encryption in Ivanti Endpoint Manager

High · published July 8, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-257 · Storing Passwords in a Recoverable Format
Published
2025-07-08T14:51Z
EPSS history
Timeline
  • 08 JUL 14:51Z
    Improper Encryption in Ivanti Endpoint Manager
    cvelistv5