CVE-2025-13661: Path Traversal in Ivanti Endpoint Manager

The impact of this vulnerability is significant. Successful exploitation allows an attacker, already authenticated within the Ivanti Endpoint Manager system, to write arbitrary files to the server's file system. This could be leveraged to overwrite critical system files, inject malicious code (e.g., web shells), or exfiltrate sensitive data. The ability to write files outside the intended directory bypasses standard security controls and significantly expands the attacker's potential impact. While user interaction is required, the attacker could potentially trick a legitimate user into initiating the file write operation, making it a viable attack vector in many environments.

1. Reserved2025-11-25
2. Published2025-12-09
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13661 is to upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict access to the vulnerable endpoint to only authorized users. Implement strict file system permissions to limit the attacker's ability to write to sensitive directories. Monitor system logs for suspicious file creation or modification activity. Consider using a Web Application Firewall (WAF) to filter requests that attempt to traverse directories, although this is not a complete solution.