CVE-2025-65115: RCE in JP1/IT Desktop Management 2

Successful exploitation of CVE-2025-65115 allows an attacker to execute arbitrary code with the privileges of the affected process. This could enable attackers to install malware, steal sensitive data, modify system configurations, or establish persistent access to the compromised system. Given the desktop management nature of the product, a successful attack could potentially impact a large number of endpoints within an organization. The blast radius extends to any data managed or accessed through the JP1/IT Desktop Management 2 system, including user credentials, software deployment packages, and configuration settings. Lateral movement within the network is also a significant concern, as an attacker could leverage the compromised system to gain access to other resources.

1. Reserved2025-11-18
2. Published2026-04-07
3. EPSS updated2026-04-14

The primary mitigation for CVE-2025-65115 is to upgrade to version 13-50-02 or later. If immediate upgrading is not feasible, consider implementing network segmentation to limit the potential impact of a successful exploit. Restrict access to the JP1/IT Desktop Management 2 - Manager service to only authorized users and systems. Monitor network traffic for suspicious activity related to the product, particularly attempts to exploit known vulnerabilities. While a WAF or proxy may not directly prevent the RCE, it can be configured to block known malicious payloads or patterns associated with exploitation attempts. After upgrading, confirm the fix by attempting to reproduce the vulnerability using known exploit techniques and verifying that the attempts are unsuccessful.