Ivanti EPM Critical Flaw Could Enable Admin Session Hijacking

Security teams around the globe are racing to respond after the discovery of a High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking. This critical flaw in Ivanti Endpoint Manager (EPM) stems from stored cross-site scripting (XSS), allowing unauthenticated attackers to inject malicious code directly into the management dashboard. With a CVSS score of 9.6 and tracked as CVE-2025-10573, the vulnerability affects all EPM versions prior to 2024 SU4 SR1. In this article, we delve deep into the mechanics of the exploit, its impact on enterprise security, and the steps you can take right now to safeguard your environment.

Understanding the Vulnerability

Before exploring mitigation strategies, it’s crucial to understand how the High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking works. At its core, this flaw relies on stored cross-site scripting, a technique where malicious scripts are saved on the target server and executed in victims’ browsers when they view the tainted content.

What Is Stored Cross-Site Scripting?

Cross-site scripting (XSS) is a common web application vulnerability that allows attackers to inject client-side scripts into pages viewed by users. When the malicious code is “stored,” it persists on the server—often in a database or content management system—until an unsuspecting administrator accesses a page that calls the tainted data. At that point, the script executes automatically in their browser, potentially stealing session cookies, redirecting to phishing sites, or performing other nefarious actions.

Deep Dive: CVE-2025-10573

The vulnerability identified as CVE-2025-10573 carries a CVSS score of 9.6, indicating critical severity. Researchers found that improper input validation on certain dashboard fields enables attackers to embed JavaScript payloads. Once an administrator logs into the Ivanti EPM console, the malicious script runs unchecked, granting full administrative control to the attacker.

Notably, this flaw affects any Ivanti EPM instance running a version prior to 2024 SU4 SR1. Given the widespread adoption of EPM for endpoint management, from patch distribution to software deployment, the potential for disruptive or destructive attacks is significant.

How Attackers Exploit the Flaw

Understanding the mechanics of an exploit can help security professionals anticipate attack patterns and deploy effective countermeasures. Below, we outline the typical stages an attacker might follow to leverage this vulnerability.

Stage 1: Initial Reconnaissance

Attackers begin by scanning networks to locate Ivanti EPM consoles exposed to public or poorly segmented internal networks. Common techniques include:

• Port scanning to identify HTTP/HTTPS services
• Web application fingerprinting to confirm EPM software
• Banner grabbing to verify version details

Stage 2: Malicious Dashboard Injection

Once the target is identified, the adversary crafts a JavaScript payload designed to snatch session cookies or issue administrative commands. By injecting the script into a vulnerable dashboard field—such as a custom widget or report name—the attacker ensures the code is stored on the EPM server.

“With stored XSS, the payload hides in plain sight, waiting for a privileged user to trigger it,” says cybersecurity expert Laura Chen. “As soon as an administrator loads the page, their session is compromised.”

Stage 3: Session Hijacking and Privilege Escalation

When the administrator next visits the manipulated dashboard, the injected script exfiltrates session tokens, granting the attacker an identical login context. From there, they can:

1. Deploy malicious packages to endpoints
2. Disable security features remotely
3. Harvest credentials or pivot to other systems

Impacts on Enterprise Environments

Given its administrative reach, the High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking poses multiple threats. We explore the two primary areas of concern below.

Session Hijacking Risks

Once in control of an administrator session, attackers effectively own the endpoint management console. They can push unauthorized software, disable patching, or harvest sensitive information, severely undermining network integrity.

Potential Data Exposure

Ivanti EPM often houses corporate assets such as software licenses, deployment logs, and configuration templates. An attacker with administrative privileges can:

• View or exfiltrate confidential reports and device inventories
• Identify security gaps in real time
• Introduce backdoors that persist even after cleanup

Real-World Incident Examples

While there have been no publicly confirmed breaches solely attributed to this exploit yet, similar XSS-driven attacks have caused major incidents. In 2023, a financial services firm lost control of its patch management server after an attacker injected a script into a report name field, leading to widespread malware installation.

Mitigation and Best Practices

To defend against this critical flaw, organizations must act swiftly. The following mitigation steps can help you secure your Ivanti EPM deployment.

Apply the Official Patch

Ivanti has released updates as part of the 2024 SU4 SR1 release. System administrators should:

1. Download the latest EPM hotfix from the Ivanti support portal
2. Schedule downtime or maintenance windows
3. Install the patch following vendor instructions
4. Verify successful version upgrade via the EPM console

Harden the EPM Console

Beyond patching, implement these hardening measures:

• Restrict console access by IP address or network segment
• Enforce multifactor authentication for all admin accounts
• Conduct routine input validation tests on custom widgets
• Monitor dashboards for unauthorized changes or new scripts

Integrate Security Monitoring

Deploy endpoint detection and response (EDR) tools to flag anomalous commands originating from the EPM server. Security information and event management (SIEM) systems can correlate:

• Unusual console logins
• Unexpected package deployments
• Repeated script execution errors

Pros and Cons of the Emergency Update

Applying emergency updates can be a double-edged sword. Below is an assessment of the benefits and drawbacks associated with the rapid deployment of EPM patches.

Benefits of Immediate Patch

• Risk Reduction: Closes the XSS attack vector before exploitation
• Regulatory Compliance: Meets security controls mandated by frameworks like NIST and ISO 27001
• Operational Continuity: Prevents potential downtime caused by malicious deployments

Challenges and Limitations

• Deployment Overhead: Scheduling and performing the update across multiple servers can disrupt operations
• Compatibility Concerns: New patches might conflict with custom scripts or integrations
• Residual Vulnerabilities: Other unrelated flaws may still be present, requiring additional hardening

Conclusion

The discovery of the High-Risk Ivanti EPM Vulnerability Opens Door to Admin Session Hijacking underscores the ever-present threat of stored cross-site scripting in enterprise software. With a critical CVE-2025-10573 rating and the potential for full console takeover, organizations cannot afford delay. By applying the official patch, reinforcing authentication controls, and enhancing monitoring, security teams can neutralize this risk and bolster their cyber resilience.

Remember, patch management is an ongoing process. Regular vulnerability assessments, combined with proactive security measures, will keep attackers at bay and ensure your endpoint management remains a shield rather than a liability.

FAQ

1. What versions of Ivanti Endpoint Manager are affected?

All Ivanti EPM installations running versions earlier than 2024 SU4 SR1 are vulnerable to CVE-2025-10573.

2. How quickly should I apply the patch?

Ivanti recommends installing the fix within 48 hours of release. If immediate patching is not feasible, restrict console access and enforce multifactor authentication as interim controls.

3. Can this vulnerability lead to remote code execution?

While the primary threat is session hijacking, an attacker with console control can upload and execute scripts on managed endpoints, effectively achieving remote code execution.

4. Are there any workarounds if I cannot patch immediately?

You can limit exposure by:

• Restricting access via firewall rules
• Disabling non-essential dashboard widgets
• Monitoring web traffic for suspicious script payload requests

5. Which cybersecurity tools help detect XSS attempts?

Web application firewalls (WAFs), interactive application security testing (IAST) solutions, and modern SIEM platforms can identify and block XSS payloads targeting Ivanti EPM.

6. How do I verify the patch was successful?

After applying the update, log into the EPM console and confirm the version matches 2024 SU4 SR1 or later. Additionally, perform an input-validation test on previously vulnerable dashboard fields.

7. Does Ivanti provide any additional guidance?

Ivanti’s support portal offers whitepapers and step-by-step patch deployment instructions, as well as recommended security best practices for EPM.