Ivanti has released security updates to address a critical vulnerability in their Endpoint Manager (EPM) product. Users and administrators of affected product versions are advised to update to the latest version immediately.
Ivanti has released security updates to address a critical vulnerability in their Endpoint Manager (EPM) product (CVE-2025-10573).
Successful exploitation of this vulnerability could allow a remote, unauthenticated attacker to execute arbitrary JavaScript code in the context of an administrator session via a Cross-Site Scripting (XSS) attack that requires user interaction.
The vulnerabilities affects the Ivanti Endpoint Manager prior to version 2024 SU4 SR1.
Users and administrators of affected products are advised to update the affected products to the latest version immediately.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
