CVE-2025-10573

No fix known EPSS 33%CVSS 9.6

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Published 2025-12-09 · CVE record · OSV

Products: ivanti endpoint_manager