Trend Micro's ZDI Discloses 13 Unpatched Ivanti Endpoint Manager Vulnerabilities Affecting Security

What's Happening?

Trend Micro’s Zero Day Initiative (ZDI) has published advisories detailing 13 unpatched vulnerabilities in Ivanti Endpoint Manager. These vulnerabilities, reported between November 2024 and June 2025, include one local privilege escalation flaw and 12 remote code execution (RCE) weaknesses. The local privilege escalation issue stems from improper validation of user-supplied input, leading to deserialization of untrusted data and code execution with System privileges. The RCE vulnerabilities involve SQL query construction using improperly validated input, potentially allowing arbitrary code execution. Ivanti has acknowledged these issues but has requested extensions for patching, citing complexity in resolving the defects.

Why It's Important?

The disclosure of these vulnerabilities is significant as they pose a high risk to users of Ivanti Endpoint Manager, with CVSS scores ranging from 7.2 to 8.8. The potential for privilege escalation and remote code execution could lead to unauthorized access and control over affected systems, impacting businesses and organizations relying on this software for endpoint management. The delay in patching these vulnerabilities raises concerns about the security posture of Ivanti and the potential exposure of its customers to cyber threats. Organizations using Ivanti products may need to implement additional security measures to mitigate risks until patches are released.

What's Next?

Ivanti has communicated its intention to release patches for these vulnerabilities, with some expected by November and others by March 2026. In the interim, ZDI advises restricting interaction with the affected product as a mitigation strategy. The cybersecurity community and affected organizations will likely monitor Ivanti's progress closely, emphasizing the need for timely and effective resolution of these security issues. The situation underscores the importance of robust vulnerability management practices and the need for vendors to prioritize security in their product development and maintenance.