CVE-2025-9872CWE-434unrestricted-file-upload

CVE-2025-9872

High · published September 9, 2025

CVSS v3.1
8.8
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15795 · 96.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-09-09T20:15Z
Affected products (14)
ProductVersionsFixed in
ivanti/endpoint_manager< 20222022
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
References (1)
https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8 · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
EPSS history
Timeline
  • 09 SEP 15:11Z
    Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote…
    cvelistv5