CVE-2025-9712CWE-434

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote…

High · published September 9, 2025

CVSS v3.1

8.8

EPSS

24%

Percentile

97.8

In the wild

Unconfirmed

What it is

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.23857 · 97.8th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-09-09T15:09Z

EPSS history

Timeline

09 SEP 15:09Z
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote…
cvelistv5