← Database

CVE-2025-10573

CRITICAL CVSS: 9.6 Published: 2025-12-09 Modified: 2026-06-17

Description

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Affected Platforms

Ivanti Endpoint Manager

Weakness Type

CWE-79

References